NSPM-C flashcards

54 cards. Read the term and the definition here. The deck at the top of this page is optional.

CSF 2.0 Functions

Six Functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern was added in version 2.0 and addresses organizational context, risk strategy, roles, policy, oversight, and supply chain.

CSF Implementation Tiers

Four tiers from Partial to Adaptive describing the rigor of cybersecurity risk governance and management. Tiers reflect organizational practice, not the maturity of individual controls.

RMF seven steps

Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. Prepare was added in SP 800-37 Rev. 2 and operates at organization and system levels.

FIPS 199 categorization

Assigns Low, Moderate, or High impact to confidentiality, integrity, and availability. The system category is the high-water mark across the three objectives.

SP 800-53 control families

Twenty families identified by two-letter codes such as AC, AU, CA, CM, IA, IR, RA, SC, SI, and SR. Rev. 5 added PT for PII processing and SR for supply chain.

Authorization to Operate

A senior official's time-bound acceptance of residual risk for a system. Alternatives include ATO with conditions, Interim ATO, and Denial of ATO.

Risk response options

Accept, Avoid, Transfer, and Mitigate. Monitoring is a continuous cross-cutting activity that supports these choices rather than a fifth response option.

Privacy Framework Functions

Five Functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P. The framework is voluntary and shares the CSF Core structure of Functions, Categories, and Subcategories.

Recovery time objective

The maximum tolerable downtime before impact becomes unacceptable. RTO must be less than or equal to the maximum tolerable downtime minus recovery effort time.

Recovery point objective

The maximum tolerable data loss expressed in time. It drives backup frequency and replication design for a system or process.

SP 800-137 continuous monitoring

Defines an ISCM program: strategy, program establishment, implementation, analysis and reporting, response, and review. Outputs support ongoing authorization decisions.

Privacy risk definition

The likelihood that an operation creates problems for individuals such as embarrassment, discrimination, or loss of autonomy. It is distinct from organizational security risk.

Security Assessment Report

Documents assessment scope, methods, findings, and evidence. It supports the authorization decision and is part of the authorization package with the SSP and POA&M.

Plan of Action and Milestones

Records weaknesses with planned remediation, resources, milestones, and status. It is reviewed at defined intervals and does not by itself permit unacceptable risk.

SP 800-171

Protects controlled unclassified information in nonfederal systems through 110 requirements across 14 families. CMMC Level 2 aligns with these requirements.

SP 800-61 Rev. 3

Aligns incident response with CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond, Recover. It supersedes the older four-phase incident response lifecycle.

Incident severity factors

Functional impact, information impact, and recoverability effort. These three factors drive escalation, notification, and resource allocation decisions.

C-SCRM per SP 800-161

Integrates supply chain risk management across the acquisition lifecycle and RMF steps. The SR control family implements it in SP 800-53 Rev. 5.

Three-tier risk hierarchy

SP 800-39 defines Tier 1 organization, Tier 2 mission or business process, and Tier 3 information system. Risk decisions flow down and risk information flows up.

Authorization package contents

System security plan, security assessment report, plan of action and milestones, and the authorization decision document. The AO signs the decision and defines its term.

Significant change examples

New interfaces, changed categorization, new processing location, or changes affecting inherited controls. Each can require reassessment before continued operation.

Assessment methods

Examine, Interview, and Test. Each SP 800-53A assessment procedure specifies the objects to examine and the methods to apply for a control.

Privacy engineering objectives

NISTIR 8062 defines predictability, manageability, and disassociability. These translate privacy risk into system design goals that engineers can implement.

Privacy Threshold Analysis

Determines whether a system processes personally identifiable information and therefore whether a Privacy Impact Assessment is required before operation.

PII confidentiality impact levels

SP 800-122 defines Low, Moderate, and High based on identifiability, quantity, sensitivity, context, and access. High requires the strongest safeguards.

Zero trust components

SP 800-207 defines the Policy Decision Point, Policy Enforcement Point, Policy Engine, and Policy Administrator. Trust is never implicit based on network location.

SP 800-160 Vol. 2

Addresses cyber resiliency: anticipate, withstand, recover from, and adapt to adverse conditions. Design principles include diversity, redundancy, and segmentation.

Awareness and training lifecycle

SP 800-50 defines design, develop, implement, and maintain phases. Role-based training is required for personnel with significant security responsibilities.

NICE Framework

Defines work roles using task, knowledge, and skill statements. It supports workforce planning, training needs analysis, and competency definition for cybersecurity roles.

FIPS versus SP 800

FIPS publications are mandatory federal standards. SP 800-series publications are guidelines that become binding through law, regulation, or contract.

Residual risk

The risk remaining after controls are applied. It must be accepted by the authorizing official and documented in the authorization decision.

FedRAMP authorization

Requires a third-party assessment organization, system security plan, assessment report, plan of action and milestones, and continuous monitoring. Agencies may reuse authorizations through reciprocity.

AI RMF Functions

Govern, Map, Measure, and Manage. The framework is voluntary and intended to be used alongside the CSF and Privacy Framework for AI risk.

Post-quantum standards

FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA were finalized in 2024. Migration planning should begin before deprecation deadlines.

SP 800-88 sanitization

Defines Clear, Purge, and Destroy actions for media sanitization before reuse, release, or disposal. Method selection depends on media type and confidentiality level.

Authenticator assurance levels

SP 800-63B defines AAL1, AAL2, and AAL3. AAL3 requires hardware-based authenticators and resistance to verifier impersonation.

FIPS 140-3

Validates cryptographic modules at security levels 1 through 4. New acquisitions should require modules validated under 140-3 as 140-2 certificates retire.

Boundary protection SC-7

Requires monitoring and control of communications at external and internal boundaries. Deny-by-default rules and DMZ architecture are common implementations.

CVSS score meaning

Measures technical severity, not organizational risk. Environmental and temporal metrics adjust the base score for context and current threat activity.

Alternate site types

Hot sites are fully operational, warm sites partially equipped, and cold sites provide space and power only. Selection depends on recovery time objectives and cost.

Controlled Unclassified Information

Governed by 32 CFR Part 2002 and the NARA CUI Registry. Handling requirements come from the applicable category and applicable contracts or laws.

Policy hierarchy

Laws and regulations, then organizational policy, then standards, then procedures and guidelines. Each lower level must trace upward to the level above it.

Mean time to detect

The average time between the start of an incident and its detection. It is a key security operations metric that should trend downward over time.

Threat hunting

A proactive, hypothesis-driven search for threats that evaded existing detection. It differs from alert-driven monitoring and produces new detection rules.

Assessment versus authorization

Assessment produces a security assessment report. Authorization produces an authorization decision such as an ATO signed by the authorizing official.

Resilience design goals

Anticipate, withstand, recover, and adapt. Design for graceful degradation and ensure recovery objectives are validated through testing.

Phishing simulation use

Results should target training and improve reporting, not punish individuals. Punitive programs reduce reporting and increase incident impact.

C2M2

A NIST-supported maturity model for cybersecurity capability in energy and other sectors. It assesses program capability across domains rather than individual controls.

OMB M-22-09

Directs federal agencies to adopt zero trust architecture with milestones tied to SP 800-207. It emphasizes identity-centric controls and continuous verification.

Tailoring versus supplementation

Tailoring removes or scopes baseline controls. Supplementation adds controls from other sources. Both must be documented and justified in the system security plan.

Compensating controls

Alternatives that provide equivalent protection when a baseline control cannot be implemented. They require authorizing official approval and documentation.

System security plan

Documents control implementation, authorization boundary, environment, and inheritance. It is the primary evidence for assessment and part of the authorization package.

Risk reporting to leadership

Reports should use business terms: likelihood, impact, and residual risk against appetite. Dashboards should show trends and exceptions, not raw control counts.

ATO versus SAR

An ATO is an authorization decision accepting risk. A SAR is an assessment product documenting findings and evidence. They serve different purposes.