Terms starting with “S”

Formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or...

A rule or set of rules that govern the acceptable use of an organization's information and services to a level of acceptable risk and the means for protecting the organization's in...

A set of criteria for the provision of security services. Source: NIST SP 800-53 Rev 4 The security status of an enterprise's networks, information, and systems based on informatio...

The security status of an enterprise's networks, information, and systems based on IA resources (e.g., people, hardware, software, policies) and capabilities in place to manage the...

In the NICE Framework, cybersecurity work where a person: Manages information security (e.g., information security) implications within the organization, specific program, or other...

Formal document that provides an overview of the security requirements for an organization-wide information security program and describes the program management security controls...

An abstract or concrete protocol that performs security-related functions. Source: CNSSP No. 15

A "punch placed on a ballot card to identify to the computer program the offices and propositions for which votes may be cast and to indicate the manner in which votes cast should...

Highest and lowest security levels that are permitted in or on an information system, system component, subsystem, or network. See system high and system low.

Requirements levied on an information system that are derived from applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or procedures, or...

Description of the minimum requirements necessary for an information system to maintain an acceptable level of risk.

Compilation of control correlation identifiers (CCIs) grouped in more applicable, specific technology areas at various levels of technology and product specificity. Contains all re...

Matrix that captures all security requirements linked to potential risks and addresses all applicable C&A requirements. It is, therefore, a correlation statement of a system's secu...

Protective measures and controls prescribed to meet the security requirements specified for an information system. Safeguards may include security features, management constraints,...

A capability that supports one, or many, of the security goals. Examples of security services are key management, access control, and authentication. Source: NIST SP 800-27 Rev A

Detailed description of the safeguards required to protect an information system. (CNSSI-4009) (NISTIR)

A number associated with the amount of work (that is, the number of operations) that is required to break a cryptographic algorithm or system. In this policy, security strength is...

nformation unit containing a representation of certain securityrelated information (e.g., a restrictive attribute bit map). (FIPS 188) (NISTIR)

An implementation-dependent statement of security needs for a specific identified target of evaluation (TOE). Source: ISO/IEC 15408-1

Based on Department of Defense (DoD) policy and security controls. Implementation guide geared to a specific product and version. Contains all requirements that have been flagged a...

(ST&E) Examination and analysis of the safeguards required to protect an information system, as they have been applied in an operational environment, to determine the security post...

Abbreviated ST&E.

Examination and analysis of the safeguards required to protect an information system, as they have been applied in an operational environment, to determine the security posture of...

Process to determine that an information system protects data and maintains functionality as intended. (CNSSI-4009) (NISTIR)