Vocabulary Flashcards
NIST
National Institute of Standards and Technology
FISMA
Federal Information System Modernization Act
What does NIST provide?
Standards of Operations and Guidelines
What does FISMA provide?
Policy and Procedures
ISSO
Information System Security Officer
SCA
Security Control Assessor
Methodology
A schedule or time frame
Vulnerability
A weakness or flaw
Risk
A chance or choice
A.O.
Authorizing Official
ATO
Authorization to Operate
Remediate
To fix
SME
Subject Matter Expert
Artifact
Proof or source
Threat
Anything that tries to exploit a vulnerability or cause harm to a system or organization
ST&E
System Test and Evaluation
CIO
Chief Information Officer
CISO
Chief Information Security Officer
Discrepancy
Mistake or error
Scrub
To look for
PM
(SME)
Project Manager
High Water Mark
The highest or most reoccurring security impact
CAT
Control Allocation Table
RTM
Required Traceable Matrix
POA&M
Plan of Action and Milestone
SAP
Security Assessment Plan
SAR
Security Assessment Report
RAR
Risk Assessment Report
SCTM
Security Control Traceable Matrix
Security Control
Something that modifies or reduces one or more security risks
System
Computer
B.O.E.
Body of Evidence
SSP
System Security Plan
C.I.A.
Confidentiality, Integrity, Availability
PII
Personally Identifiable Information
PKI
Public Key Infrastructure
ISO
International Organization for Standardization
IEC
International Electrotechnical Commission
CDS
Cross Domain Solution
IC
Intelligent Control (Intelligence Community)
NIST-800-30
Conducting Risk Assessements
NIST-800-37
RMF 1-7
NIST-800-39
Managing Risk
NIST-800-18
How to develop an SSP (Creation of the SSP)
GSS
General Support System
Confidentiality
The state of keeping a secret or private
Integrity
Seeking to prevent the unauthorized modification, use, and destruction of information or data
Availability
Ensure timely and reliable access and use of information
FIPS
Federal Information Processing Standards
FIPS-199
The security categorization of Federal systems and the second step in RMF Categorization.
NIST-800-53
Information Types
NIST-800-53A
Data
NIST-800-53B
Baseline controls for REV5
NIST-800-60
Mapping
NIST Special Publication 200
Basic Controls
DHS Sensitive System Policy Directive 4300A
Directive used if you need overlays, privacy controls, or cross domain solutions
ISO/IEC 27001 & 27002
Communication
CNSS-1253
Committee on National Security Systems (Military)
Formal Written Direction
URL
Web site
Screen Shot
Real time picture with date and time stamp
Test the control
To observe something is working properly
Interview
To speak with someone to get an explanation or better understanding of the control function.
Examine
Physically review the control documentation.
