CSF Glossary: Difference between revisions

From CMMC Toolkit Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
 
Line 61: Line 61:
|Function
|Function
|One of the main components of the Framework. Functions provide the highest level of structure for organizing basic cybersecurity activities into Categories and Subcategories. The five functions are Identify, Protect, Detect, Respond, and Recover.
|One of the main components of the Framework. Functions provide the highest level of structure for organizing basic cybersecurity activities into Categories and Subcategories. The five functions are Identify, Protect, Detect, Respond, and Recover.
|}
== F ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|Facility
|Physical means or equipment for facilitating performance of an action, e.g., buildings, instruments, tools.
|
* NIST SP 800-160
|-
|Federal Contract Information (FCI)
|Federal contract information means information, not intended for public release, that is provided by or generated for Government under a contract to develop or deliver a product or service to Government, but not including information provided by Government to public (such as on public websites) or simple transactional information, such as necessary to process payments.
|
* 48 CFR § 52.204-21
|-
|Federated Trust
|Trust established within a federation or organization, enabling each of mutually trusting realms to share and use trust information (e.g., credentials) obtained from any of other mutually trusting realms.This trust can be established across computer systems and networks architectures.
|
* NIST SP 800-95
|-
|Federation
|A collection of realms (domains) that have established trust amongThe mselves. level of trust may vary, but typically includes au ntication and may include authorization.
|
* NIST SP 800-95
|-
|Firewall
|A device or program that controls flow of network traffic between networks or hosts that employ differing security postures.
|
* NIST SP 800-41 Rev 1
|-
|Flash Drive
|A removable storage device that utilizes USB port of a system for data transfer.
|
* CMMC
|}
== G ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|Government Property
|All property owned or leased by Government. Government property includes both Government-furnished and Contractor-acquired property. Government property includes material, equipment, special tooling, special test equipment, and real property. Government property does not include intellectual property or software.
|
* FAR 52.245-1
|}
== H ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|High-Value Asset (HVA)
|Asset, organization information system, information, and data for which an unauthorized access, use, disclosure, disruption, modification, or destruction could cause a significant impact to organization’s interests, relations, economy, or to employee or stockholder confidence, civil liberties, or health and safety of organization’s people. An HVA may contain sensitive controls, instructions, data used in critical organization operations, or unique collections of data (by size or content), or support an organization’s mission essential functions, making it of specific value to criminal, politically motivated, or state sponsored actors for either direct exploitation or to cause a loss of confidence in organization.
|
* OMB M-17-09 (adapted)
|-
|High-Value Service
|Service on which success of organization’s mission depends.
|
* CERT RMM v.12
|}
|}


== I ==
== I ==
{|class="wikitable" style="width: 85%;"
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 20%"| Term
! style="width: 65%"| Description
! style="width: 80%"| Description
! style="width: 20%"| Source
|-
|-
|Identification
|Identify (function)
|The process of discovering true identity (i.e., origin, initial history) of a person or item from entire collection of similar persons or items.
|Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.
|
* CNSSI 4009-2015
* FIPS 201-1
* NIST SP 800-79-2
|-
|-
|Identity
|Informative Reference
|The set of attribute values (i.e., characteristics) by which an entity is recognizable and that, within scope of an identity manager’s responsibility, is sufficient to distinguish that entity from any other entity.
|A specific section of standards, guidelines, and practices common among critical infrastructure sectors that illustrates a method to achieve the outcomes associated with each Subcategory. An example of an Informative Reference is ISO/IEC 27001 Control A.10.8.3, which supports the “Data-in-transit is protected” Subcategory of the “Data Security” Category in the “Protect” function.
Note: This also encompasses non-person entities (NPEs).
|
* NIST SP 800-161
* NISTIR 7622
* CNSSI 4009
|-
|Identity-Based Access Control (IBAC)
|Access control based on identity of user (typically relayed as a characteristic of process acting on behalf of that user) where access authorizations to specific objects are assigned based on user identity.
|
* CERT RMM v1.2
|-
|Identity, Credential, and Access Management (ICAM)
|Programs, processes, technologies, and personnel used to create trusted digital identity representations of individuals and non-person entities (NPEs), bind those identities to credentials that may serve as a proxy for individual or NPE in access transactions, and leverage credentials to provide authorized access to an organization‘s resources.  
See Glossary: Attribute-Based Access Control (ABAC)
|
* CNSSI 4009 (adapted)
|-
|Identity Management System
|Identity management system comprised of one or more systems or applications that manages identity verification, validation, and issuance process.
|
* NISTIR 8149
|-
|Incident
|An occurrence that actually or potentially jeopardizes confidentiality, integrity, or availability of a system or information system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.
|
* NIST SP 800-171 Rev 2
|-
|Incident Handling (Incident Response)
|The actions organization takes to prevent or contain impact of an incident to organization while it is occurring or shortly after it has occurred.
|
* CERT RMM v1.2
|-
|Incident Response (IR)
|See Glossary: Incident Handling
|
|-
|Incident Stakeholder
|A person or organization with a vested interest in management of an incident throughout its life cycle.
|
* CERT RMM v1.2
|-
|Industrial Control System (ICS)
|General term that encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCSs), and other control system configurations such as programmable logic controllers (PLCs) found in industrial sectors and critical infrastructures.An industrial control system consists of combinations of control components (e.g., electrical, mechanical, hydraulic, pneumatic) that act toge r to achieve an industrial objective (e.g., manufacturing, transportation of matter or energy).
|
* NIST SP 800-53 Rev 5
|-
|Industrial Internet of Things (IIoT)
|See Glossary: Internet of Things (IoT)
|
|-
|Information Asset Container
|See Glossary: Container
|
|-
|Information Asset Owner
|See Glossary: Asset Owner
|
|-
|Information Flow
|The flow of information or connectivity from one location to another. This can be related to data as well as connectivity from one system to another, or from one security domain to ano r. authorization granting permission for information flow comes from a control authority granting permission to an entity, asset, role, or group.
|
* CMMC
|-
|Information System (IS)
|A discrete set of information resources organized for The collection, processing, maintenance, use, sharing, dissemination, or disposition of information.
|
* NIST 800-171 Rev 2
|-
|Information System Component
|A discrete, identifiable information technology asset (e.g., hardware, software, firmware) that represents a building block of an information system, excluding separately authorized systems to which information system is connected. Information system components include commercial information technology products.
|
* CNSSI 4009-2015
* NIST SP 800-53 Rev 4 (adapted)
|-
|Insider
|Any person with authorized access to any organization or United States Government resource to include personnel, facilities, information, equipment, networks, or systems.
|
* CNSSD No. 504
|-
|Insider Threat
|The threat that an insider will use her/his authorized access, wittingly or unwittingly, to do harm to security of organization or United States. This threat can include damage to United States through espionage, terrorism, unauthorized disclosure, or through loss or degradation of departmental resources or capabilities.
|
* CNSSD No. 504 (adapted)
|-
|Insider Threat Program
|A coordinated collection of capabilities authorized by Department/Agency (D/A) that is organized to deter, detect, and mitigate unauthorized disclosure of sensitive information.
|
* CNSSD No. 504
|-
|Integrity
|The security objective that generates requirement for protection against ei r intentional or accidental attempts to violate data integrity (The property that data has not been altered in an unauthorized manner) or system integrity (The quality that a system has when it performs its intended function in an unimpaired manner, free from unauthorized manipulation).
|
* NIST SP 800-33
|-
|Internet of Things (IoT)
|Interconnected devices having physical or virtual representation in digital world, sensing/actuation capability, and programmability features.The y are uniquely identifiable and may include smart electric grids, lighting, heating, air conditioning, and fire and smoke detectors.
|
* iot.ieee.org/definition
* NIST SP 800-183
|-
|Inventory
|The physical or virtual verification of presence of each organizational asset.
|
* CNSSI 4005 (adapted)
|}
 
== L ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|Least Privilege
|A security principle that restricts access privileges of authorized personnel (e.g., program execution privileges, file modification privileges) to minimum necessary to performThe ir jobs.
|
* NIST SP 800-57 Part 2
|-
|Life Cycle
|Evolution of a system, product, service, project, or other human-made entity from conception through retirement.
|
* NIST SP 800-161
|}
|}


== M ==
== M ==
{|class="wikitable" style="width: 85%;"
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 20%"| Term
! style="width: 65%"| Description
! style="width: 80%"| Description
! style="width: 20%"| Source
|-
|Maintenance
|Any act that ei r prevents failure or malfunction of equipment or restores its operating capability.
|
* NIST SP 800-82 Rev 2
|-
|Malicious Code
|Software or firmware intended to perform an unauthorized process that will have adverse impact on confidentiality, integrity, or availability of an information system. A virus, worm, Trojan horse, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code.
|
* CNSSI 4009
|-
|Malware
|Software or firmware intended to perform an unauthorized process that will have adverse impact on confidentiality, integrity, or availability of an information system. A virus, worm, Trojan horse, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code (malware).
|
* NIST SP 800-82 Rev 2
|-
|Maturity Model
|A maturity model is a set of characteristics, attributes, or indicators that represent progression in a particular domain. A maturity model allows an organization or industry to have its practices, processes, and methods evaluated against a clear set of requirements (such as activities or processes) that define specific maturity levels. At any given maturity level, an organization is expected to exhibit capabilities of that level. A tool that helps assess current effectiveness of an organization, and supports determining what capabilitiesThe y need in order to obtain next level of maturity in order to continue progression up levels of model.
|
* CERT RMM v1.2
|-
|Media
|Physical devices or writing surfaces including but not limited to, magnetic tapes, optical disks, magnetic disks, Large-Scale Integration (LSI) memory chips, printouts (but not including display media) onto which information is recorded, stored, or printed within an information system.
|
* FIPS 200
|-
|Media Sanitization
|The actions taken to render data written on media unrecoverable by both ordinary and extraordinary means.
|
* NIST SP 800-88 Rev 1
|-
|-
|Mobile Code
|Mobile Code
|Software programs or parts of programs obtained from remote systems, transmitted across a network, and executed on a local system without explicit installation or execution by recipient.
|A program (e.g., script, macro, or other portable instruction) that can be shipped unchanged to a heterogeneous collection of platforms and executed with identical semantics.
Note: Some examples of software technologies that provide mechanisms for production and use of mobile code include Java, JavaScript, ActiveX, VBScript, etc.
|
* NIST SP 800-53 Rev 5
* NIST SP 800-18
* CNSSI 4009
|-
|Mobile Device
|A portable computing device that:
* has a small form factor such that it can easily be carried by a single individual;
* is designed to operate without a physical connection (e.g., wirelessly transmit or receive information);
* possesses local, non-removable data storage; and
* is powered on for extended periods of time with a self-contained power source.
Mobile devices may also include voice communication capabilities, on-board sensors that allow device to capture (e.g., photograph, video, record, or determine location) information, and/or built-in features for synchronizing local data with remote locations.Examples include smart phones, tablets, and e-readers.
Note: If device only has storage capability and is not capable of processing or transmitting/receiving information,The n it is considered a portable storage device, not a mobile device.
See Glossary: Portable Storage Device
Note: Laptops are excluded from scope of this definition (see NIST SP 800-124).
|
* NIST SP 800-53 Rev 5
|-
|Monitor
|The act of continually checking, supervising, critically observing, or determining status in order to identify change from performance level required or expected at an organizationally defined frequency and rate.
|
* NIST SP 800-160 (adapted)
|-
|Multifactor Authentication (MFA)
|An authentication system or an authenticator that requires more than one authentication factor for successful authentication. Multifactor authentication can be performed using a single authenticator that provides more than one factor or by a combination of authenticators that provide different factors.
The three authentication factors are something you know, something you have, and something you are.
See Glossary: Authenticator
|
* NIST SP 800-53 Rev 5
|}
 
== O ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|Ongoing Basis
|Actions occurring, indefinitely. Actions that do not stop unless a stop action is purposely put in place.
|
* CMMC
|-
|Operational Resilience
|The ability of systems to resist, absorb, and recover from or adapt to an adverse occurrence during operation that may cause harm, destruction, or loss of ability to perform mission- related functions.
|
* CNSSI 4009
|-
|Operational Technology (OT)
|Hardware and software that detects or causes a change through direct monitoring and/or control of physical devices, processes and events in enterprise.
|
* DOE O 205.1C
* Department of Energy Cyber Security Program
|-
|Organization
|An entity of any size, complexity, or positioning within an organizational structure (e.g., a federal agency, or, as appropriate, any of its operational elements).
See Glossary: Enterprise
|
* NIST SP 800-37 Rev 1
|-
|Organization Seeking Certification (OSC)
|The entity that is going through CMMC assessment process to receive a level of certification for a given environment.
|
* CMMC
|-
|Organizational Asset
|See Glossary: Asset
|
* NISTIR 7693
* NISTIR 7694
|-
|Organizational System(s)
|The term organizational system is used in many of CUI security requirements in NIST Special Publication 800-171.This term has a specific meaning regarding scope of applicability for CUI security requirements. requirements apply only to components of nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. appropriate scoping for security requirements is an important factor in determining protection-related investment decisions and managing security risk for nonfederal organizations that have responsibility of safeguarding CUI.
|
* NIST SP 800-171 Rev 1
|-
|Organizationally Defined
|As determined by contractor being assessed. This can be applied to a frequency or rate at which something occurs within a given time period, or it could be associated with describing configuration of a contractor’s solution.
|
* CMMC
|-
|Out-of-Scope Asset
|Out-of-Scope Assets cannot process, store, or transmit CUI becauseThe y are physically or logically separated from CUI Assets or are inherently unable to do so.
|
* CMMC
|}
|}


== P ==
== P ==
{|class="wikitable" style="width: 85%;"
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 20%"| Term
! style="width: 65%"| Description
! style="width: 80%"| Description
! style="width: 20%"| Source
|-
|Patch
|An update to an operating system, application, or other software issued specifically to correct particular problems with software.
|
* NIST SP 800-123
|-
|Penetration Testing (Pentesting)
|Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent security features of an application, system, or network. Penetration testing often involves issuing real attacks on real systems and data, using same tools and techniques used by actual attackers. Most penetration tests involve looking for combinations of vulnerabilities on a single system or multiple systems that can be used to gain more access than could be achieved through a single vulnerability.
|
* NIST SP 800-115
|-
|Periodically
|Occurring at regular intervals. As used in many practices within CMMC, interval length is organizationally defined to provided contractor flexibility, with an interval length of no more than one year.
|
* Oxford Dictionary (adapted)
|-
|Personally Identifiable Information (PII)
|Information that can be used to distinguish or trace an individual’s identity, ei r alone or when combined with other information that is linked or linkable to a specific individual.
|
* NIST SP 800-53 Rev 5
|-
|Plan
|An artifact or collection of artifacts that provides oversight for implementing defined CMMC policies. A plan should include a mission and/or vision statement, strategic goals/objectives, relevant standards and procedures, and people, funding, and tool resources needed to implement defined CMMC policies.
|
* CMMC
|-
|Policy
|An artifact or collection of artifacts that establishes governance over implementation of CMMC practices and activities. policy should include stated purpose, defined scope, roles and responsibilities of activities covered by policy, and any included regulatory guidelines. policy should establish or direct establishment of procedures to carry out and meet intent of policy and should be endorsed by senior management to show its support of policy.
|
* CMMC
|-
|Portable Storage Device
|A system component that can be inserted into and removed from a system, and that is used to store data or information (e.g., text, video, audio, and/or image data). Such components are typically implemented on magnetic, optical, or solid-state devices (e.g., floppy disks, compact/digital video disks, flash/thumb drives, external hard disk drives, and flash memory cards/drives that contain nonvolatile memory).
|
* NIST SP 800-171 Rev 2
|-
|Practice
|An activity or set of activities that are performed to meet defined CMMC objectives.
|
* CMMC
|-
|Privilege
|A right granted to an individual, a program, or a process.
|
* CNSSI 4009, NIST SP 800-12 Rev 1
|-
|-
|Privileged Account
|Protect (function)
|A user, system, or network account authorized (and,The refore, trusted) to perform security- relevant functions that ordinary accounts are not authorized to perform.
|Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.
|
* NIST SP 800-171 Rev. 2 (adapted)
|-
|-
|Privileged User
|Privileged User
|A user who is authorized (and,The refore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform.
|A user that is authorized (and, therefore, trusted) to perform security�-relevant functions that ordinary users are not authorized to perform.
|
* NIST SP 800-171 Rev. 2
|-
|Procedure
|The documented details for how an activity is implemented to achieve a desired outcome.A procedure should provide enough detail for a trained individual to perform activity.
|
* CMMC
|-
|Process
|A procedural activity that is performed to implement a defined objective.
|
* CMMC
|-
|Proxy (Web Proxy)
|An application that “breaks” connection between client and server. proxy accepts certain types of traffic entering or leaving a network and processes it and forwards it.
Note: This effectively closes straight path between internal and external networks making it more difficult for an attacker to obtain internal addresses and other details of organization’s internal network. Proxy servers are available for common Internet services; for example, a hypertext transfer protocol (HTTP/HTTPS) proxy used for Web access.
|
* CNSSI 4009 (adapted)
|}
|}


== R ==
== R ==
{|class="wikitable" style="width: 85%;"
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 20%"| Term
! style="width: 65%"| Description
! style="width: 80%"| Description
! style="width: 20%"| Source
|-
|Real Time, Real-Time (modifier)
|Pertaining to performance of a computation during actual time that related physical process transpires so that results of computation can be used to guide physical process.
|
* NIST SP 800-82 Rev. 2
* NISTIR 6859
|-
|Recovery
|Actions necessary to restore data files of an information system and computational capability after a system failure.
|
* CNSSI 4009
|-
|Red Team
|A group of people authorized and organized to emulate a potential adversary’s attack or exploitation capabilities against an enterprise’s security posture. Red Team’s objective is to improve enterprise Information Assurance by demonstrating impacts of successful attacks and by demonstrating what works for defenders (i.e., Blue Team) in an operational environment.
|
* CNSSI 4009
|-
|-
|Red Teaming
|Recover (function)
|The act(s) performed by a “red team” in order to identify weaknesses, vulnerabilities, procedural shortcomings, and misconfigurations within an organization’s cyber environment. Red Teaming includes creation of a “Rules of Engagement” document by which red team honors over course of their actions. It is expected that Red Team will produce a final report at end of event period.
|Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.
|
* CMMC
|-
|-
|Regularly
|Respond (function)
|On a regular basis: at regular intervals.
|Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.
|
* Oxford Dictionary
|-
|Remote Access
|Access to an organizational system by a user (or a process acting on behalf of a user) communicating through an external network (e.g., Internet).
|
* NIST SP 800-171 Rev. 2
|-
|Removable Media
|Portable data storage medium that can be added to or removed from a computing device or network.
Note: Examples include, but are not limited to: optical discs (CD, DVD, Blu-ray); external/removable hard drives; external/removable Solid-State Disk (SSD) drives; magnetic/optical tapes; flash memory devices (USB, eSATA, Flash Drive, Thumb Drive); flash memory cards (Secure Digital, CompactFlash, Memory Stick, MMC, xD); and other external/removable disks (floppy, Zip, Jaz, Bernoulli, UMD).
See Glossary: Portable Storage Device
|
* CNSSI 4009
|-
|Reporting [forensics]
|The final phase of computer and network forensic process, which involves reporting results of analysis; this may include describing actions used, explaining how tools and procedures were selected, determining what other actions need to be performed (e.g., forensic examination of additional data sources, securing identified vulnerabilities, improving existing security controls), and providing recommendations for improvement to policies, guidelines, procedures, tools, and other aspects of The forensic process.The formality of reporting step varies greatly depending on situation.
|
* NIST SP 800-86
|-
|Residual Risk
|Portion of risk remaining after security measures have been applied.
|
* NIST SP 800-33 (adapted)
|-
|Resilience
|The ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruptions. Resilience includes ability to withstand and recover from deliberate attacks, accidents, or naturally occurring threats or incidents.
|
* PPD 21
|-
|Restricted Information Systems
|Systems (and associated IT components comprising system) that are configured based on government requirements (i.e., connected to something that was required to support a functional requirement) and are used to support a contract (e.g., fielded systems, obsolete systems, and product deliverable replicas).
|
* CMMC
|-
|-
|Risk
|Risk
|A measure of extent to which an entity is threatened by a potential circumstance or event, and typically a function of:
|A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.
* The adverse impacts that would arise if circumstance or event occurs and
* The likelihood of occurrence.
System-related security risks are those risks that arise from loss of confidentiality, integrity, or availability of information or systems. Such risks reflect potential adverse impacts to organizational operations, organizational assets, individuals, other organizations, and Nation.
|
* FIPS 200 (adapted)
|-
|-
|Risk Analysis
|Risk Management
|The process of identifying risks to system security and determining likelihood of occurrence, resulting impact, and additional safeguards that mitigate this impact.Part of risk management and synonymous with risk assessment.
|The process of identifying, assessing, and responding to risk.
|
* NIST SP 800-27
|-
|Risk Assessment
|
* The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and Nation, resulting from operation of a system.
* Part of risk management, incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis.
|
* NIST SP 800-171
|-
|Risk Management (RM)
|The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and Nation, and includes:
* establishing context for risk-related activities,
* assessing risk,
* responding to risk once determined, and
* monitoring risk over time.
|
* CNSSI 4009
|-
|Risk Mitigation
|Prioritizing, evaluating, and implementing The appropriate risk-reducing controls/ countermeasures recommended from risk management process.
|
* CNSSI 4009
|-
|Risk Mitigation Plan
|A strategy for mitigating risk that seeks to minimize risk to an acceptable level.
|
* CERT RMM v1.2
|-
|Risk Tolerance
|The level of risk an entity is willing to assume in order to achieve a potential desired result.
|
* CNSSI 4009
|-
|Root-Cause Analysis
|An approach for determining underlying causes of events or problems as a means of addressing symptoms of such events asThe y manifest in organizational disruptions.
|
* CERT RMM v1.2
|-
|Root Directory
|The top-level directory in a folder hierarchy.
|
* CMMC
|}
|}


== S ==
== S ==
{|class="wikitable" style="width: 85%;"
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 20%"| Term
! style="width: 65%"| Description
! style="width: 80%"| Description
! style="width: 20%"| Source
|-
|-
|Safeguards
|Subcategory
|The protective measures prescribed to meet security requirements (i.e., confidentiality, integrity, and availability) specified for an information system. Safeguards may include security features, management constraints, personnel security, and security of physical structures, areas, and devices. Synonymous with security controls and countermeasures.
|The subdivision of a Category into specific outcomes of technical and/or management activities. Examples of Subcategories include “External information systems are catalogued,” “Data-at-rest is protected,” and “Notifications from detection systems are investigated.”
|
* FIPS 200
|-
|-
|Sandboxing
|Supplier
|A restricted, controlled execution environment that prevents potentially malicious software, such as mobile code, from accessing any system resources except those for which software is authorized.
|Product and service providers used for an organization’s internal purposes (e.g., IT infrastructure) or integrated into the products of services provided to that organization’s Buyers.
|
* CNSSI 4009
|-
|Scanning
|Sending packets or requests to another system to gain knowledge about asset, processes, services, and operations.
|
* CNSSI 4009 (adapted)
|-
|Security Assessment
|See Glossary: Security Control Assessment
|
|-
|Security Control Assessment (Security Assessment, Security Practice Assessment)
|The testing or evaluation of security controls to determine extent to which controls are implemented correctly, operating as intended, and producing desired outcome with respect to meeting security requirements for a system or organization.
|
* CNSSI 4009 (adapted)
|-
|Security Domain
|An environment or context that includes a set of system resources and a set of system entities that have right to access resources as defined by a common security policy, security model, or security architecture.
|
* CNSSI 4009
|-
|Security Operations Center (SOC)
|A centralized function within an organization utilizing people, processes, and technologies to continuously monitor and improve an organization's security posture while preventing, detecting, analyzing, and responding to cybersecurity incidents.
|
* CMMC
|-
|Security Policy
|Security policies define objectives and constraints for security program. Policies are created at several levels, ranging from organization or corporate policy to specific operational constraints (e.g., remote access). In general, policies provide answers to questions “what” and “why” without dealing with “how.” Policies are normally stated in terms that are technology-independent.
|
* NIST SP 800-82 Rev 2
|-
|Security Protection Assets
|Security provide security functions or capabilities within contractor’s CMMC Assessment Scope.
|
* CMMC
|-
|Security Practice Assessment
|See Glossary: Security Control Assessment
|
|-
|Sensitive Information
|Information where loss, misuse, or unauthorized access or modification could adversely affect national interest or conduct of federal programs, or privacy to which individuals are entitled under 5 U.S.C. Section 552a (The Privacy Act).
|
* NIST SP 800-53 Rev 4 (adapted)
|-
|Separation of Duties
|Refers to principle that no user should be given enough privileges to misuse system onThe ir own. For example, person authorizing a paycheck should not also be one who can prepareThe m.Separation of duties can be enforced ei r statically (by defining conflicting roles, i.e., roles which cannot be executed by same user) or dynamically (by enforcing control at access time).
|
* NIST SP 800-192
|-
|Service Continuity Plan
|A service-specific plan for sustaining services and associated assets under degraded conditions.
|
* CERT RMM v1.2
|-
|SHA-256
|A Secure Hash Algorithm (SHA) that produces a condensed representation of electronic data, or message digest, 256 bits in length.
|
* FIPS 180-4
|-
|Situational Awareness (SA)
|Within a volume of time and space, perception of an enterprise’s security posture and its threat environment; comprehension/meaning of both taken toge r (risk); and projection ofThe ir status into near future.
|
* CNSSI 4009
|-
|Specialized Asset
|The following are considered specialized assets for CMMC: Government Property, Internet of Things (IoT) or Industrial Internet of Things (IIoT), Operational Technology (OT), and Restricted Information Systems.
|
* CMMC
|-
|Split Tunneling
|The process of allowing a remote user or device to establish a non-remote connection with a system and simultaneously communicate via some other connection to a resource in an external network. This method of network access enables a user to access remote devices (e.g., a networked printer) at same time as accessing uncontrolled networks.
|
* NIST SP 800-171
|-
|Spyware
|Software that is secretly or surreptitiously installed into an information system to ga r information on individuals or organizations withoutThe ir knowledge; a type of malicious code.
|
* NIST SP 800-53 Rev 5
|-
|Standards
|A document, established by consensus and approved by a recognized body, that provides for common and repeated use, rules, guidelines or characteristics for activities or their results, aimed at achievement of optimum degree of order in a given context.
Note: Standards should be based on consolidated results of science, technology and experience, and aimed at promotion of optimum community benefits.
|
* NISTIR 8074 Vol. 2
|-
|Standard Process
|An operational definition of basic process that guides establishment of a common process in an organization. A standard process describes fundamental process elements that are expected to be incorporated into any defined process. It also describes relationships (e.g., ordering, interfaces) amongThe se process elements.
See Glossary: Defined Process
|
* CERT RMM v1.2
|-
|Subnetwork
|A subordinate part of an organization’s enterprise network.
|
* CMMC
|-
|Supply Chain
|A system of organizations, people, activities, information, and resources, possibly international in scope, that provides products or services to consumers.
|
* CNSSI 4009
|-
|Supply Chain Attack
|Attacks that allow adversary to utilize implants or other vulnerabilities inserted prior to installation in order to infiltrate data, or manipulate information technology hardware, software, operating systems, peripherals (information technology products) or services at any point during life cycle.
|
* CNSSI 4009
|-
|Supply Chain Risk Management (SCRM)
|A systematic process for managing supply chain risk by identifying susceptibilities, vulnerabilities, and threats throughout supply chain and developing mitigation strategies to combat those threats whe r presented by supplier, supplied product and its subcomponents, or supply chain (e.g., initial production, packaging, handling, storage, transport, mission operation, and disposal).
|
* CNSSD No. 505
|-
|Sustain
|Maintain a desired operational state.
|
* CERT RMM v1.2
|-
|System Assets
|Any software, hardware (IT, OT, IoT), data, administrative, physical, communications, or personnel resource within an information system.
|
* CNSSI 4009
|-
|System Boundary
|The scope of system and environment being assessed. All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which information system is connected. System Boundary is equivalent to defined CMMC Assessment Scope.
See Glossary: CMMC Assessment Scope
|
* CNSSI 4009-2015 under authorization boundary NIST SP 800-53 Rev. 4
* NIST SP 800-53A Rev. 1
* NIST SP 800-37 Rev. 1
|-
|System Integrity
|The quality that a system has when it performs its intended function in an unimpaired manner, free from unauthorized manipulation of system, whe r intentional or accidental.
|
* NIST SP 800-27
|-
|System Interconnection
|A system interconnection is defined as direct connection of two or more IT systems for purpose of sharing data and other information resources.
|
* NIST 800-47
|-
|System Security Plan (SSP)
|The formal document prepared by information system owner (or common security controlsThe ownerThe forThe inheritedThe controls)The thatThe providesThe anThe overviewThe ofThe  security requirements for system and describes security controls in place or planned for meeting those requirements. plan can also contain as supporting appendices or as references, other key security-related documents such as a risk assessment, privacy impact assessment, system interconnection agreements, contingency plan, security configurations, configuration management plan, and incident response plan.
|
* CNSSI 4009
|}
|}


== T ==
== T ==
{|class="wikitable" style="width: 85%;"
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 20%"| Term
! style="width: 65%"| Description
! style="width: 80%"| Description
! style="width: 20%"| Source
|-
|Tampering
|An intentional but unauthorized act resulting in modification of a system, components of systems, its intended behavior, or data.
|
* NIST SP 800-53 Rev 5
|-
|Test Equipment
|Hardware and/or associated IT components used in testing of products, system components, and contract deliverables (e.g., oscilloscopes, spectrum analyzers, power meters, and special test equipment).
|
* CMMC
|-
|Threat
|Any circumstance or event with potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.
|
* NIST SP 800-30 Rev 1
|-
|Threat Actor
|An individual or a group posing a threat.
|
* NIST SP 800-150
|-
|Threat Intelligence
|Threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide necessary context for decision-making processes.
|
* NIST SP 800-150
|-
|Threat Monitoring
|Analysis, assessment, and review of audit trails and other information collected for purpose of searching out system events that may constitute violations of system security.
|
* CNSSI 4009
|-
|Trigger
|A set of logic statements to be applied to a data stream that produces an event when an anomalous incident or behavior occurs.
|
* CNSSD No. 504 (adapted)
|-
|Trojan Horse
|A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes program.
|
* CNSSI 4009
|-
|Tunneling
|Technology enabling one network to send its data via another network’s connections.Tunneling works by encapsulating a network protocol within packets carried by second network.
|
* CNSSI 4009
|}
 
 
== U ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|Unauthorized Access
|Any access that violates stated security policy.
|
* CNSSI 4009
|-
|User
|Individual, or (system) process acting on behalf of an individual, authorized to access a system.
|
* NIST SP 800-53 Rev 5
|}
 
== V ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|Virus
|A computer program that can copy itself and infect a computer without permission or knowledge of user. A virus might corrupt or delete data on a computer, use e-mail programs to spread itself to other computers, or even erase everything on a hard disk.
See Glossary: Malicious Code
|
* CNSSI 4009
|-
|Vulnerability
|Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.
|
* NIST SP 800-30 Rev 1
|-
|Vulnerability Assessment
|Systematic examination of an information system or product to determine adequacy of security measures, identify security deficiencies, provide data from which to predict effectiveness of proposed security measures, and confirm adequacy of such measures after implementation.
|
* CNSSI 4009
|-
|Vulnerability Management
|An Information Security Continuous Monitoring (ISCM) capability that identifies vulnerabilities [Common Vulnerabilities and Exposures (CVEs)] on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to network.
|
* NISTIR 8011 Vol. 1
|}
 
== W ==
{|class="wikitable" style="width: 85%;"
! style="width: 15%"| Term
! style="width: 65%"| Description
! style="width: 20%"| Source
|-
|Web Proxy
|See Glossary: Proxy
|
|-
|-
|Whitelist
|Taxonomy
|An approved list or register of entities that are provided a particular privilege, service, mobility, access or recognition.
|A scheme of classification.
An implementation of a default deny-all or allow-by-exception policy across an enterprise environment, and a clear, concise, timely process for adding exceptions when required for mission accomplishments.
|
* CNSSI 1011
|}
|}

Latest revision as of 20:00, 9 April 2023

Source of Reference: official Cybersecurity Framework Components from National Institute of Standards and Technology (NIST).

For inquiries and reporting errors on this wiki, please contact us. Thank you.

B

Term Description
Buyer The people or organizations that consume a given product or service.

C

Term Description
Category The subdivision of a Function into groups of cybersecurity outcomes, closely tied to programmatic needs and particular activities. Examples of Categories include “Asset Management,” “Identity Management and Access Control,” and “Detection Processes.”
Critical Infrastructure Systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on cybersecurity, national economic security, national public health or safety, or any combination of those matters.
Cybersecurity The process of protecting information by preventing, detecting, and responding to attacks.
Cybersecurity Event A cybersecurity change that may have an impact on organizational operations (including mission, capabilities, or reputation).
Cybersecurity Incident A cybersecurity event that has been determined to have an impact on the organization prompting the need for response and recovery.

D

Term Description
Detect (function) Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

F

Term Description
Framework A risk-based approach to reducing cybersecurity risk composed of three parts: the Framework Core, the Framework Profile, and the Framework Implementation Tiers. Also known as the “Cybersecurity Framework.”
Framework Core A set of cybersecurity activities and references that are common across critical infrastructure sectors and are organized around particular outcomes. The Framework Core comprises four types of elements: Functions, Categories, Subcategories, and Informative References.
Framework Implementation Tier A lens through which to view the characteristics of an organization’s approach to risk—how an organization views cybersecurity risk and the processes in place to manage that risk.
Framework Profile A representation of the outcomes that a particular system or organization has selected from the Framework Categories and Subcategories.
Function One of the main components of the Framework. Functions provide the highest level of structure for organizing basic cybersecurity activities into Categories and Subcategories. The five functions are Identify, Protect, Detect, Respond, and Recover.

I

Term Description
Identify (function) Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.
Informative Reference A specific section of standards, guidelines, and practices common among critical infrastructure sectors that illustrates a method to achieve the outcomes associated with each Subcategory. An example of an Informative Reference is ISO/IEC 27001 Control A.10.8.3, which supports the “Data-in-transit is protected” Subcategory of the “Data Security” Category in the “Protect” function.

M

Term Description
Mobile Code A program (e.g., script, macro, or other portable instruction) that can be shipped unchanged to a heterogeneous collection of platforms and executed with identical semantics.

P

Term Description
Protect (function) Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.
Privileged User A user that is authorized (and, therefore, trusted) to perform security�-relevant functions that ordinary users are not authorized to perform.

R

Term Description
Recover (function) Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.
Respond (function) Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.
Risk A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.
Risk Management The process of identifying, assessing, and responding to risk.

S

Term Description
Subcategory The subdivision of a Category into specific outcomes of technical and/or management activities. Examples of Subcategories include “External information systems are catalogued,” “Data-at-rest is protected,” and “Notifications from detection systems are investigated.”
Supplier Product and service providers used for an organization’s internal purposes (e.g., IT infrastructure) or integrated into the products of services provided to that organization’s Buyers.

T

Term Description
Taxonomy A scheme of classification.
Retrieved from "https://cmmcwiki.org/index.php?title=CSF_Glossary&oldid=573"