NSPM-C key terms

A safeguard or countermeasure prescribed for an information system or organization to protect the confidentiality, integrity, and availability of the system and its information, and to meet a defined set of requirements.

The process of determining the criticality and sensitivity of information and the system that processes it by evaluating the potential impact of a loss of confidentiality, integrity, or availability using low, moderate, or high levels.

A pre-defined, ready-to-use set of security controls selected for a system based on its impact categorization, which can then be tailored to address specific organizational or system needs.

The process of reviewing and adjusting a control baseline by adding, removing, or modifying controls so the resulting set is appropriate for the specific mission, environment, and risk profile of an organization or system.

A specification of security controls and supplemental guidance that applies a defined set of requirements to a baseline, allowing organizations to address shared missions, technologies, or environments without rebuilding controls from scratch.

A supplemental requirement added to a base security control to strengthen it, increase its rigor, or extend its scope for systems with greater risk or more demanding protection needs.

The defined perimeter that establishes which components, people, processes, and information are inside a system under consideration for risk management and which are external to it.

The set of information resources, including people, processes, and technologies, managed by an authorizing official for which responsibility and accountability for security and privacy risk are accepted.

A senior official or executive with the authority to formally accept responsibility for operating a system at an acceptable level of risk to organizational operations, assets, individuals, other organizations, and the nation.

A formal, time-limited decision by an authorizing official granting permission to operate a system, based on evidence that controls are implemented and residual risk is acceptable to the organization.

A document that describes the system boundary, environment of operation, how security requirements are met, and the planned and implemented controls, serving as the primary record supporting authorization decisions.

A management document that records identified control weaknesses, the planned corrective actions, assigned responsibility, and scheduled completion dates for remediating deficiencies found during assessment or monitoring.

The process of testing, examining, and interviewing to determine whether implemented controls are effective, operate as intended, and produce the expected outcomes against stated requirements.

A document defining the scope, methods, objects, assessors, and schedule for evaluating controls, ensuring the assessment is repeatable, defensible, and aligned with the system's security objectives.

The deliverable of an assessment that documents findings, the effectiveness of controls, identified weaknesses, and the evidence supporting conclusions used by the authorizing official in risk decisions.

An ongoing program of monitoring security and privacy controls, changes, and threats to maintain situational awareness and support timely risk-based decisions throughout the system lifecycle.

A deliberate decision by an accountable official to tolerate a residual risk without further mitigation, supported by documented rationale and an understanding of potential consequences.

The level of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively or quantitatively and used to guide decisions about whether to mitigate, transfer, avoid, or accept risk.

The process of identifying threats and vulnerabilities, estimating likelihood and impact, and determining risk levels to inform decisions about treatment and prioritization of safeguards.

An entity or circumstance with the potential to exploit a vulnerability and cause harm, characterized by its intent, capability, and targeting of an organization or system.

A weakness in a system, control, process, or implementation that could be exploited by a threat source to compromise confidentiality, integrity, or availability.

An estimate of the probability that a threat event will occur or that a vulnerability will be exploited, considering threat capability, intent, and the exposure of the affected asset.

An evaluation of the adverse effects on organizational operations, assets, individuals, or other organizations if a threat event occurs, often expressed as low, moderate, or high magnitude.

A measurable metric used to signal changes in an organization's risk exposure, enabling early warning and trend analysis so management can act before losses materialize.

A connection between two or more systems that allows data exchange or shared resources, requiring documented agreements and controls to manage the resulting security and privacy risk.

The risk that products, services, or components acquired from external parties introduce vulnerabilities, malicious functionality, or dependencies that undermine the security and resilience of a system.

Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information linked or linkable to that individual.

An analysis of how information is handled that evaluates privacy risks, ensures compliance with legal requirements, and documents controls for protecting personally identifiable information throughout the information lifecycle.

The likelihood and impact of problems arising from the collection, use, disclosure, retention, or disposal of personal information that could harm individuals or erode trust.

The principle of collecting, using, and retaining only the personal information that is directly relevant and necessary to accomplish a specified purpose, reducing exposure and privacy risk.

The practice of clearly stating, before or at the time of collection, why personal information is gathered and how it will be used, so that later uses can be evaluated for compatibility.

A defined schedule and set of rules governing how long personal information is kept, where it is stored, and how it is destroyed once the business or legal need ends.

The process of removing or altering identifiers so that personal information cannot be linked to a specific individual, reducing privacy risk while preserving usefulness for analysis.

Data whose unauthorized disclosure could cause harm or embarrassment, requiring stronger protections than ordinary information because of legal, contractual, or mission-related obligations.

A safeguard or countermeasure that manages privacy risk by governing how personal information is collected, used, shared, retained, and disposed of in accordance with requirements.

A determination of how well an implemented control achieves its intended outcome, considering design, implementation, and operating results rather than mere presence.

The process of deciding which controls, systems, locations, and components are within the boundary of an assessment or authorization effort, documenting exclusions and their justification.