Lesson 2 Definitions

Question 1

Sensitive Information

Answer 1

Information where the loss, misuse, or unauthorized access or modification could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act).

Question 2

Federal Contract Information (FCI)

Answer 2

Information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

Question 3

Controlled Unclassified Information (CUI)

Answer 3

Information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended.

Question 4

Controlled Technical Information (CTI)

Answer 4

Technical Information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Question 5

Export-Controlled Information (ECI)

Answer 5

Any information or material that cannot be released to foreign nationals or representatives of a foreign entity, without first obtaining approval or license from the Dept. of State for items controlled by ITAR or the Dept. of Commerce for items controlled by the Export Administration Regulations (EAR).

Question 6

Covered Defense Information (CDI)

Answer 6

Terms used to identify information that requires protection under DFARS Clause 252.204-7012. Unclassified CTI or other information, as described in the CUI Registry, that requires safeguarding or dissemination controls pursuant to and consistent with the law, regulations, and government-wide policies.

Question 7

Lawful government purpose

Answer 7

Any activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes as within the scope of its legal authorities or the legal authorities of non-executive branch entities (such as state and local law enforcement).

Question 8

Data Integrity

Answer 8

Property that data has not been altered in an unauthorized manner

Question 9

Confidentiality

Answer 9

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information

Question 10

Personally Identifiable Information (PII)

Answer 10

Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a speficic individual

Question 11

Multifactor Authentication (MFA)

Answer 11

A mechanism that provides for added protection of data through electronic methods

Question 12

Awareness

Answer 12

A learning process that sets the state for training by changing individual and organizational attitudes to realize the importance of security and the adverse consequences of its failure.

Question 13

Awareness and Training Program

Answer 13

Explains proper rules of behavior for the use of agency information systems and information. The program communicates information technology (IT) security policies and procedures that need to be followed. (i.e., NSTISSD 501, NIST SP 800-50)

Question 14

Configuration Management

Answer 14

A collection of activities focused on establishing and maintaining the integrity of information technology products and systems, through control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the system development life cycle.

Question 15

Encryption

Answer 15

The process of changing plaintext into cipher text

Question 16

Network Segmentation

Answer 16

The use of physical devices such as firewalls or logical separation such as subnetting to create distinct segments in your internal network

Question 17

Demilitarized Zone (DMZ)

Answer 17

A small section of a private network that is located between two firewalls and made available for public access

Question 18

Dissemination control

Answer 18

Method of managing sensitive information distribution so that it doesn’t spread more widely than allowed by law, regulation, or government-wide policy

Question 19

Decontrolling CUI

Answer 19

Decontrolling occurs when an authorized holder, consistent with CUI regulations and the CUI Registry, removes safeguarding and dissemination controls from CUI that no longer requires such controls.

Question 20

Record

Answer 20

Agency records and Presidential papers or Presidential records (or Vice-Presidential), as those terms are defined in 44 U.S.C. 3301 and 44 U.S.C. 2201 and 2207. Records are also items created or maintained by a Government contractor, licensee, certificate holder, or grantee that are subject to the sponsoring agency’s control under the terms of the entity’s agreement with the agency.

Question 21

Media sanitization

Answer 21

The actions taken to render data written on media unrecoverable by both ordinary and extraordinary means.