CAP1 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk

The potential for a circumstance or event to cause adverse effects; expressed as a function of the likelihood of a threat event and the impact if it occurs.

FIPS 199

A federal standard requiring categorization of information and information systems by potential impact to confidentiality, integrity, and availability as low, moderate, or high.

High water mark

The rule that a system's overall security category equals the highest impact level among the confidentiality, integrity, and availability categories of the information it processes or stores.

Three-tier risk management

NIST's structure for addressing risk at the organization level (Tier 1), the mission or business process level (Tier 2), and the information system level (Tier 3).

Risk response options

The choices for handling risk: acceptance (retain), avoidance (eliminate the activity), mitigation (apply controls to reduce), and transfer or sharing, such as through insurance.

Authorization boundary

All system components, users, data, facilities, and interconnections under one risk management authority that are covered by a single authorization decision.

SP 800-60

NIST guidance that maps information types to provisional confidentiality, integrity, and availability impact values, supporting FIPS 199 categorization and system boundary scoping.

Common controls

Controls implemented by an organizational provider and inherited by multiple information systems; their implementation and evidence are documented by the provider, not each system owner.

Interconnection security agreement

A document between organizations that defines the technical and security requirements, data flows, and responsibilities for connecting two information systems.

Enclave

A subset of an information system with a defined boundary that shares common security policies and controls, used to scope assessment and authorization activities.

Baseline control set

A predefined set of security and privacy controls for an impact level (low, moderate, or high) in SP 800-53B that serves as the starting point for tailoring.

Tailoring

The process of adjusting a baseline by scoping out inapplicable controls, assigning parameter values, applying compensating controls, and adding supplemental controls with justification.

Scoping

The tailoring step that identifies which baseline controls apply to a system's environment of operation and technology, excluding controls that are not applicable.

Overlay

A set of control additions, removals, and substitutions applied to a baseline to address a specific community, mission, technology, or privacy need.

Control allocation

The assignment of each selected control to an implementing entity - organization (common), system (system-specific), or both (hybrid) - documented in the security plan.

System security plan

The document describing a system's boundary, selected controls, implementation status and details, and responsible entities; it is the central artifact of the RMF.

Implementation status

The security plan entry for each control marked implemented, partially implemented, planned, or alternative, with a description of how the control requirement is satisfied.

Compensating control

A control used in place of a recommended control when the original is not feasible, providing equivalent or comparable protection that is justified and documented.

Configuration baseline

The documented and approved set of configuration settings for system components, maintained through configuration management to detect and prevent unauthorized change.

Inherited controls

Controls implemented by another entity, such as a common control provider, whose implementation a system owner relies on and records in the system security plan.

Security assessment plan

The document defining the scope, controls, assessment methods, evidence objects, and schedule for assessing a system, derived from SP 800-53A assessment procedures.

Examine, interview, test

The three assessment methods defined in SP 800-53A for collecting evidence about whether security and privacy control objectives are satisfied.

Security assessment report

The assessor's document reporting assessment results, control effectiveness findings, and identified weaknesses, which supports the authorization decision and the POA&M.

Plan of action and milestones

A management document tracking identified weaknesses, planned remediation actions, responsible parties, resources, and completion dates until the weaknesses are resolved.

Authorization to operate

The authorizing official's formal decision to accept residual risk and permit a system to operate, based on the security plan, assessment report, and POA&M.

Interim authorization to operate

A time-limited authorization allowing a system to operate while specified weaknesses are remediated according to the plan of action and milestones.

Residual risk

The risk remaining after security and privacy controls have been implemented and assessed; the authorizing official formally accepts it on behalf of the organization.

Authorization package

The set of documents given to the authorizing official: the security plan, security assessment report, plan of action and milestones, and the authorization decision document.

Continuous monitoring

Ongoing assessment of controls, vulnerabilities, and system changes to maintain awareness of security and privacy posture and to support ongoing authorization decisions.

ISCM

Information security continuous monitoring: a program that collects, analyzes, and reports security-related data at a frequency sufficient to support risk-based decisions.

Significant change

A change to a system that likely affects its security posture, such as a new boundary, interconnection, or technology, triggering reassessment and possible reauthorization.

Ongoing authorization

Maintaining an authorization decision over time by continuously monitoring controls and reporting status to the authorizing official rather than reauthorizing only periodically.