CAP1 key terms

A structured, repeatable process for integrating security, privacy, and supply chain risk activities into the system development life cycle, organized into steps that begin with categorization and end with continuous monitoring.

The set of policies, roles, responsibilities, and oversight mechanisms an organization uses to direct and hold accountable how security and privacy risks are managed across its mission and business processes.

The amount of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively or quantitatively, and used to guide decisions about control selection, assessment depth, and authorization.

The decision to accept, avoid, mitigate, transfer, or share a risk, chosen after evaluating likelihood and impact against organizational risk tolerance and documented in risk registers or plans of action.

A model that addresses risk at the organization level, the mission or business process level, and the information system level, linking enterprise objectives to system-level controls.

A senior official or group that oversees risk management across the organization, helps establish risk tolerance, and facilitates cross-organizational sharing of risk information without owning individual system authorizations.

The official responsible for carrying out the organization's information security program, including developing policy, coordinating assessments, and reporting security posture to senior leadership.

An analysis of how personally identifiable information is collected, used, shared, and retained, used to identify privacy risks and to ensure legal and policy requirements are met before a system is deployed.

A public notice describing a group of records containing personal information, including the purpose, routine uses, retention, and access procedures, required when records are retrieved by a personal identifier.

The process of identifying, assessing, and mitigating risks introduced by suppliers, products, and services across the acquisition life cycle, including counterfeits, tampering, and dependency on untrusted vendors.

The process of determining the potential impact of a loss of confidentiality, integrity, and availability on organizational operations, assets, or individuals, producing a low, moderate, or high rating that drives baseline selection.

The federal standard that defines security categories based on the potential impact of compromising confidentiality, integrity, or availability and establishes the high-water mark rule for overall system categorization.

The documented set of components, users, data flows, and interfaces that a categorization and authorization effort treats as the system under consideration, distinguishing inside elements from the environment.

The specific scope of components, applications, and data covered by a single authorization decision, which may include multiple systems and is defined by the authorizing official and system owner.

A direct connection between two systems that allows data exchange, requiring documented agreements, security controls at the interface, and approval from the authorizing officials of both parties.

A category of information with common characteristics, such as protected health information or financial records, used to identify privacy and security requirements that flow down to the systems that process it.

The official accountable for a mission or business process supported by a system, who defines requirements, accepts residual risk at the process level, and participates in categorization and authorization decisions.

A pre-defined set of security and privacy controls for a given impact level, drawn from a catalog, which serves as the starting point for tailoring to the system's specific mission, environment, and risk.

The process of adjusting a control baseline by adding, removing, or compensating for controls to reflect the system's specific characteristics, mission needs, and environment of operation, with documented rationale.

A set of control modifications applied on top of a baseline to address a specific community, technology, or mission context, such as cloud, industrial control systems, or privacy-specific requirements.

An alternative control used when a required baseline control cannot be applied as written, providing equivalent or greater protection and requiring documented justification and approval.

A security or privacy control implemented by an organization and inherited by multiple systems, reducing duplication and requiring documented responsibility between the provider and consuming systems.

The transfer of responsibility for a control's implementation and assessment from a providing entity to consuming systems, documented so that each system's security plan reflects actual coverage.

The document describing a system's boundary, categorization, controls, implementation details, and responsibilities, serving as the primary record of how the system meets its security and privacy requirements.

The actual deployment and configuration of selected controls in a system's environment, including technical settings, procedures, and assigned responsibilities, which must match what the security plan claims.

The disciplined process of identifying, controlling, and auditing changes to system components and settings so that implemented controls remain effective and unauthorized changes are detected and reversed.

An independent evaluation of whether controls are implemented correctly, operating as intended, and producing the desired outcome, using examination, interview, and testing methods against defined assessment objectives.

The technique used to gather evidence during a control assessment, typically examining documents, interviewing personnel, or testing mechanisms, chosen to match the control and the desired confidence level.

The deliverable that documents assessment findings, including control effectiveness, identified weaknesses, and the assessor's judgment about the system's security posture, supporting the authorization decision.

The principle that the party evaluating controls should not report to or be influenced by those responsible for implementing them, preserving objectivity in findings and conclusions.

The collection of documents-categorization, security plan, assessment report, and plan of action and milestones-that an authorizing official reviews to make an authorization decision.

A senior official with the authority to accept risk on behalf of the organization and to grant, deny, or revoke authority to operate a system based on the authorization package.

A formal decision by an authorizing official that a system may operate for a specified period, based on evidence that its controls provide adequate protection and residual risk is acceptable.

The explicit decision by an accountable official to tolerate identified residual risk, documented with rationale, conditions, and any required compensating measures or time limits.

A management document listing identified weaknesses, planned remediation actions, resources, and completion dates, used to track risk reduction and support continuous monitoring.

The ongoing process of collecting and analyzing security and privacy data-such as vulnerability scans, configuration checks, and control assessments-to maintain awareness of risk and support ongoing authorization.

An approach where the authorization decision remains valid as long as continuous monitoring shows that risk stays within tolerance, rather than expiring at a fixed date.

Automated probing of systems and networks to identify known weaknesses and misconfigurations, providing recurring evidence for continuous monitoring and triggering remediation when findings exceed thresholds.

A judgment about whether a control is implemented correctly, operating as intended, and producing the intended outcome, expressed in assessment findings and monitored over time.