Terms starting with “R”

The report which contains the results of performing a risk assessment or the formal output from the process of assessing risk. Source: NIST SP 800-30 Rev 1

The individual, group, or organization responsible for conducting a risk assessment. Source: NIST SP 800-30 Rev 1

(or Risk Executive Function) An individual or group within an organization that helps to ensure that: (CNSSI-4009; SP 800-53A; SP 800-37; SP 800-39) (NISTIR)

An individual or group within an organization that helps to ensure that (i) security risk- related considerations for individual information systems, to include the authorization d...

The largest statistical probability that, if an outcome is wrong, the RLA does not correct that outcome. For example, assume the reported outcome of an election contest is wrong, a...

The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, indi...

A structured approach used to oversee and manage risk for an enterprise. (CNSSI-4009) (NISTIR)

A structured approach used to oversee and manage risk for an enterprise.

Prioritizing, evaluating, and implementing the appropriate risk-reducing controls/countermeasures recommended from the risk management process.

A key component of a risk assessment methodology (in addition to assessment approach and analysis approach) that defines key terms and assessable risk factors. (SP 800-30) (NISTIR)

Maintaining ongoing awareness of an organization's risk environment, risk management program, and associated activities to support risk decisions. (SP 800-30; SP 800-39) (NISTIR)

Accepting, avoiding, mitigating, sharing, or transferring risk to organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, ot...

A specific action taken to respond to an identified risk. (SP 800-39) (NISTIR)

The level of risk an entity is willing to assume in order to achieve a potential desired result. Source: NIST SP 800-32

(RAdAC) A form of access control that uses an authorization policy that takes into account operational need, risk, and heuristics. (CNSSI-4009) (NISTIR)

A structured approach to managing risks to data and information by which an organization selects and applies appropriate security controls in compliance with policy and commensurat...

A statistical audit process that confirms whether an election outcome is correct by examining a random sample of ballots, requiring progressively larger samples if discrepancies ar...

Risk-limiting audits provide statistical assurance that election outcomes are correct by manually examin- ing portions of paper ballots or voter-verifiable paper records.

A risk-limiting audit is a type of post-election audit, during which a random sample of ballots is selected and the selections on the ballots are compared to the electronic "cast v...

Post-election tabulation audit procedure for checking a sample of ballots (or voter verifiable records) that provides a pre-specified statistical chance of correcting the reported...

Risk-Limiting Audit

A wireless security network that only allows the creation of Robust Security Network Associations (RSNAs). (SP 800-48) (NISTIR)

A logical connection between communicating IEEE 802.11 entities established through the IEEE 802.11i key management scheme, also known as the four-way handshake. (SP 800-48) (NISTI...

The ability of an information assurance (IA) entity to operate correctly and reliably across a wide range of operational conditions, and to fail gracefully outside of that operatio...