Glossary

Terms from the modules published so far. More are added as modules are released.

Filter terms

AI use case inventory: An agency's list of its uses of artificial intelligence. (Module 9)
Alternative implementation: An implementation status showing a compensating control is used in place of the baseline control. (Module 4)
Application allow-listing: Permitting only approved software to run. (Elective E1)
Assessment object: What an assessment method is applied to: specifications, mechanisms, activities, or individuals. (Module 5)
Asymmetric encryption: Cryptography using a public key and a private key; what one locks only the other unlocks. (Module 0)
Authentication: Proving that you are who you claim to be. (Module 0)
Authorization: Deciding what an authenticated identity is allowed to do. (Module 0)
Authorization boundary: The line around everything an authorizing official accepts risk for. (Module 2)
Authorization decision document: The signed record of the authorizing official's decision, its conditions, and its termination date. (Module 6)
Authorization package: The security plan, assessment report, and plan of action and milestones presented for an authorization decision. (Module 2)
Authorization termination date: The date after which a time-limited authorization is no longer valid. (Module 6)
Authorization to operate (ATO): A senior official's formal decision to accept the risk of running a federal system. (Module 0)
Authorization to use: A decision to accept the risk of using a system or service already authorized by another organization. (Module 6)
Authorizing official (AO): The senior federal official who formally accepts the risk of operating a system. (Module 1)
Automatable: Able to be exploited by an attacker scripting every step. (Module 7)
Automated check: A defined, repeatable test a machine runs against a control's state. (Elective E2)
Availability: Information and systems are accessible when needed. (Module 0)
Binding operational directive: A compulsory direction from CISA to federal civilian agencies. (Module 1)
Binding Operational Directive (BOD): A compulsory direction from CISA to federal civilian executive branch agencies. (Module 7)
Body of evidence: The complete set of documents and technical evidence supporting an authorization decision. (Module 4)
Boundary: The line around the components a system owner is responsible for. (Module 0)
Building automation system (BAS): A system that controls building services such as ventilation. (Elective E1)
Capstone: A final project that brings together the skills from a whole course. (Module 10)
Catalog (OSCAL): A machine-readable set of controls, such as SP 800-53. (Elective E2)
Certification Class: The current FedRAMP levels, A to D, replacing Low, Moderate, and High labels. (Module 8)
Change control: The process of proposing, reviewing, approving, implementing, and recording changes. (Module 7)
Chief AI Officer (CAIO): The agency official responsible for AI governance. (Module 9)
CIDR notation: A way of writing a group of IP addresses, such as 10.0.1.0/24. (Module 0)
Closure evidence: Dated proof, verified independently, that a weakness is corrected. (Module 7)
Common control authorization: A decision that the risk of providing a set of common controls for inheritance is acceptable. (Module 6)
Common control provider: The party that implements a control inherited by one or more systems. (Module 1)
Common Vulnerabilities and Exposures (CVE): The standard identifier for a published vulnerability. (Module 7)
Common Vulnerability Scoring System (CVSS): A 0 to 10 severity score for a vulnerability. (Module 7)
Compensating control: An alternative safeguard used when a baseline control cannot be implemented. (Module 3)
Complementary user entity controls: Controls a vendor's audit report assumes the customer will perform. (Module 5)
Component definition: A machine-readable description of what a product or service provides toward controls. (Elective E2)
Conditional ATO: Agency term for an authorization to operate that carries terms and conditions. (Module 6)
Conduit: A controlled communication path between zones. (Elective E1)
Confidentiality: Only authorized people can see the information. (Module 0)
Container: A package holding one application and the files it needs, sharing the host's kernel. (Module 0)
Continuous control validation: Automated, repeated checking that a control is in place and working. (Elective E2)
Continuous Event Monitoring (CEM): Ongoing collection and review of security events to detect activity as it happens. (Module 7)
Control: A safeguard that reduces risk. (Module 0)
Control assessor: The person or team that independently tests whether controls work. (Module 1)
Control baseline: The predefined starting set of controls for an impact level. (Module 3)
Control enhancement: An addition that strengthens a base control, written with a number in parentheses. (Module 3)
Control family: One of the twenty groups of related controls, such as Access Control (AC). (Module 3)
Control plane: The management layer of a cloud service, where resources and permissions are created and changed. (Module 9)
Coverage: How much is looked at in an assessment: the breadth of documents, people, or instances. (Module 5)
Critical error: A mistake serious enough to fail the capstone regardless of points. (Module 10)
Crypto-agility: The ability to change cryptographic algorithms without redesigning a system. (Module 9)
Cryptographic bill of materials (CBOM): A machine-readable inventory of cryptographic assets. (Module 9)
Cryptographic inventory: A list of where and how cryptography is used in a system. (Module 9)
Customer responsibility: A control or part of a control the provider leaves to the customer. (Module 8)
Customer responsibility matrix: A cloud provider's control-by-control statement of what the customer must do. (Module 3)
CVE (Common Vulnerabilities and Exposures): A public identifier for one specific vulnerability. (Module 0)
CVSS (Common Vulnerability Scoring System): A 0-to-10 severity score for a vulnerability. (Module 0)
Data call: A request from the agency for information from system teams by a set date. (Module 9)
Data flow diagram: A drawing of how information enters, moves through, rests in, and leaves a system. (Module 4)
Data loss prevention policy: Platform rules restricting where data may be sent. (Module 8)
Default deny: Blocking all traffic except what a rule explicitly allows. (Module 0)
Denial of authorization: A decision that risk is unacceptable; the system may not start or must halt. (Module 6)
Depth: How thorough an examination, interview, or test is. (Module 5)
Designated representative: A person acting for the authorizing official on everything except the authorization decision. (Module 1)
Determination memo: A one-page recommendation on using a service, with findings and conditions. (Module 8)
Determination statement: A single, separately assessable statement within a control's assessment procedure. (Module 5)
Deviation (operational requirement): An approved decision not to remediate in the standard way because of a mission need. (Module 7)
Directory service: A central store of accounts, such as Active Directory. (Module 0)
DNS (Domain Name System): The service that translates names into IP addresses. (Module 0)
Drift: The gradual divergence of a system from its documentation. (Module 4)
Emergency change: A change made at once to restore service or stop harm, analyzed afterward. (Module 7)
Escalation: Informing someone with more authority in time for them to act. (Module 7)
Evidence index: A table of evidence items with their location, owner, and refresh cadence. (Module 4)
Evidence request list: The assessor's itemized list of evidence required from the system's team. (Module 5)
Evidence store: Where dated check results are kept for assessors. (Elective E2)
Excessive agency: Giving an AI system more permission to act than its task requires. (Module 9)
Executive summary: The short statement of a package's key facts, risks, and requested decision. (Module 6)
Exit plan: The arrangement for retrieving data and ending use of a service. (Module 8)
External system service: A service provided from outside the system's authorization boundary. (Module 8)
False positive: A reported weakness shown not to exist. (Module 7)
FedRAMP: The Federal Risk and Authorization Management Program, the government-wide program for assessing cloud services. (Module 0)
FedRAMP 20x: The FedRAMP certification type based on automated, machine-readable evidence. (Module 8)
FedRAMP Certification: The program's current term for the status of a cloud service that meets its requirements. (Module 8)
Finding: A documented result that a requirement is not met, with condition, criterion, cause, and effect. (Module 5)
FIPS (Federal Information Processing Standard): A mandatory standard for federal agencies, issued by NIST. (Module 0)
Firewall: A device or service that allows or blocks network traffic according to rules. (Module 0)
FISMA: The Federal Information Security Modernization Act, the law requiring agencies to run information security programs. (Module 0)
Forensic triage: Checking whether an asset has already been compromised. (Module 7)
GRC engineering: Applying engineering practices to governance, risk, and compliance work. (Elective E2)
Guidance: A source that advises and becomes mandatory only when a binding instrument requires its use. (Module 1)
Harvest now, decrypt later: Collecting encrypted data today to decrypt once a capable quantum computer exists. (Module 9)
Hash: A fixed-length, one-way fingerprint of data. (Module 0)
High-impact AI: AI whose output is a principal basis for decisions with significant effects on rights, safety, or critical services. (Module 9)
High-water mark: The rule that a system's impact level is the highest of its confidentiality, integrity, and availability ratings. (Module 2)
Historian: An OT server that records process data over time. (Elective E1)
Hybrid control: A control partly inherited and partly implemented by the system. (Module 3)
Hypervisor: Software that divides a physical server into virtual machines. (Module 0)
Identity provider: A service that authenticates users on behalf of applications. (Module 0)
Impact level: Low, Moderate, or High: the severity of harm if a security objective were lost. (Module 2)
Implementation statement: The paragraph in a security plan describing how a control is carried out for the system. (Module 4)
Implementation status: Whether a control is implemented, partially implemented, planned, alternative, inherited, or not applicable. (Module 4)
Industrial control system (ICS): Systems that control industrial processes. (Elective E1)
Information exchange: Movement of information between systems with different owners or boundaries. (Module 8)
Information Security Continuous Monitoring (ISCM): Maintaining ongoing awareness of security, vulnerabilities, and threats to support risk decisions. (Module 7)
Information type: A category of information from the SP 800-60 catalog, used as the basis for categorization. (Module 2)
Infrastructure as a Service (IaaS): The provider supplies computing infrastructure; the customer runs systems on it. (Module 8)
Inheritance: Relying on a safeguard that another party fully performs. (Module 0)
Inherited risk: Risk a system carries from open weaknesses in a provider's controls. (Module 3)
Initial remediation: Fixing findings during an assessment and having the assessor re-check them. (Module 5)
Inject: A new event introduced during an exercise to change the situation. (Module 10)
Inspector general: The independent office that evaluates an agency's security program each year. (Module 1)
Integrity: Information is accurate and has not been improperly changed. (Module 0)
Interconnection: A connection between a system and one outside its boundary. (Module 2)
Interconnection security agreement (ISA): The document setting the technical and security terms of a connection. (Module 8)
Interim authorization to test (IATT): Agency term for short-term, limited permission to operate for testing. (Module 6)
ISSM (Information System Security Manager): A common title for someone overseeing several ISSOs or systems; not a NIST-defined role. (Module 1)
ISSO (Information System Security Officer): The person responsible for a system's security day to day. (Module 0)
Jump server: A hardened intermediate system through which remote users must connect. (Elective E1)
Just-in-time access: Privileged access granted for a limited time when requested and approved. (Module 9)
Key establishment: The process by which two parties agree a shared secret key. (Module 9)
Key Security Indicator (KSI): A measurable security outcome a 20x provider demonstrates with evidence. (Module 8)
Known Exploited Vulnerabilities (KEV) catalog: CISA's list of vulnerabilities known to be exploited. (Module 7)
Known-good configuration: A verified copy of a device's configuration or logic, used for comparison and recovery. (Elective E1)
Lapse: An authorization passing its termination date without a new decision. (Module 6)
Large language model (LLM): An AI model trained on large amounts of text to generate and interpret language. (Module 9)
Least privilege: Giving each account only the access its job requires. (Module 0)
Leveraged authorization: Reliance on another system's authorization, typically a cloud provider's. (Module 3)
Lock-in: Dependence on a product that is hard to leave because data cannot be moved. (Elective E2)
Logging profile: A system document listing events logged, their purposes, alerts, and retention. (Module 9)
Logging Reference Architecture: CISA's architecture for federal logging, called for by M-26-14. (Module 9)
Low-code platform: A platform that lets people build applications with little or no programming. (Module 8)
Machine identity: The credentials a service or workload uses to authenticate. (Module 9)
Machine-readable: In a structured format a program can process reliably. (Elective E2)
Maintenance window: A planned period when a process can safely be interrupted. (Elective E1)
Microsegmentation: Dividing a network so each component can reach only what it needs. (Module 9)
Milestone: An observable step toward correcting a weakness, with its own date. (Module 7)
Monitoring strategy: The document stating what is monitored, how, how often, by whom, and what happens with results. (Module 7)
Multifactor authentication (MFA): Sign-in requiring two or more different kinds of proof. (Module 0)
National security system: A system handling classified or certain defense and intelligence functions, governed by separate rules. (Module 1)
NICE Framework: NIST's description of cybersecurity work roles and their tasks, knowledge, and skills. (Module 1)
OMB (Office of Management and Budget): The body that issues government-wide information security policy. (Module 1)
One-way gateway (data diode): A device that lets data flow out of a network but not in. (Elective E1)
Ongoing authorization: Keeping an authorization continuously current through monitoring instead of fixed-cycle reauthorization. (Module 2)
Open Security Controls Assessment Language (OSCAL): NIST's machine-readable formats for controls, implementations, and assessments. (Elective E2)
Operational technology (OT): Programmable systems or devices that monitor or control physical processes. (Elective E1)
Organization-defined parameter (ODP): A value the organization supplies to make a control specific. (Module 3)
Orphaned application: An application whose owner has left and has not been replaced. (Module 8)
OSCAL: Open Security Controls Assessment Language, a machine-readable format for security documentation. (Module 4)
OT overlay: A tailoring of the SP 800-53 baselines for operational technology, in SP 800-82 Rev. 3. (Elective E1)
Other than satisfied: The result when evidence shows a requirement is not met or cannot be shown to be met. (Module 5)
Overlay: A prepared set of tailoring decisions for a particular technology, community, or mission. (Module 3)
Passive network monitoring: Observing network traffic without sending any. (Elective E1)
Personally identifiable information (PII): Information that can distinguish or trace an individual's identity, alone or combined. (Module 2)
Phishing: A deceptive message that tricks someone into revealing information or running harmful software. (Module 0)
Phishing-resistant multi-factor authentication: Sign-in that cannot be relayed through a fake site, such as hardware keys or smart cards. (Module 9)
PIV card: The Personal Identity Verification smart card issued to federal employees and contractors. (Module 0)
Plan of action and milestones (POA&M): The record of known weaknesses, who will fix them, and by when. (Module 2)
Platform as a Service (PaaS): The provider also supplies the runtime and managed components. (Module 8)
Policy as code: Expressing a security rule so a machine can enforce or check it. (Elective E2)
Port: A number identifying which program on a device should receive network traffic. (Module 0)
Post-quantum cryptography (PQC): Cryptography designed to resist attack by quantum and classical computers. (Module 9)
Posture report: The periodic summary of a system's security state for the authorizing official. (Module 7)
Presumption of adequacy: The statutory expectation that agencies accept a FedRAMP assessment as sufficient. (Module 8)
Priority inversion: In OT, ranking safety and availability above confidentiality. (Elective E1)
Privacy baseline: The set of controls added when a system processes personal information. (Module 3)
Privacy impact assessment (PIA): The analysis of how a system collects, uses, shares, and protects personal information. (Module 2)
Privacy threshold analysis (PTA): A screening determination of whether a system involves personal information. (Module 2)
Profile (OSCAL): A selection and tailoring of controls from a catalog, such as a baseline. (Elective E2)
Programmable logic controller (PLC): A rugged computer that runs control logic for machinery. (Elective E1)
Prompt injection: Manipulating an AI system through instructions hidden in content it processes. (Module 9)
Proper nouns test: A check that a statement contains system-specific names and values, not just the control's wording. (Module 4)
Provisional impact level: The recommended impact level for an information type, adjustable with rationale. (Module 2)
Public trust position: A role requiring a background investigation but not a security clearance. (Module 1)
Public-key (asymmetric) cryptography: Cryptography using paired public and private keys, for key agreement and signatures. (Module 9)
Purdue model: A widely used layered reference model for OT networks. (Elective E1)
Request for information (RFI): A focused set of questions and evidence requests sent to a vendor. (Module 8)
Requirements register: A list of applicable requirements and their status for a system or program. (Module 9)
Rescission: The formal withdrawal of a policy. (Module 9)
Residual risk: The risk remaining after controls and compensating measures are taken into account. (Module 6)
Risk: The likelihood that a threat exploits a vulnerability, combined with the impact. (Module 0)
Risk acceptance: The authorizing official's explicit, documented decision to operate with a risk. (Module 6)
Risk executive (function): The role or group that views risk across the whole organization. (Module 1)
Risk Management Framework (RMF): The seven-step process in NIST SP 800-37 for managing system security and privacy risk. (Module 2)
Risk response: The choice to accept, avoid, mitigate, share, or transfer a risk. (Module 6)
Risk tolerance: The level of risk an organization is willing to accept, set at the organization level. (Module 6)
Rules of engagement: Agreed limits on technical testing: what, when, from where, and what is off limits. (Module 5)
Safe state: A condition in which a process presents no hazard. (Elective E1)
Safety instrumented system (SIS): An independent system that brings a process to a safe state. (Elective E1)
Safety review: Evaluation by safety professionals of whether an action could create a hazard. (Elective E1)
Sample: A subset of a population chosen for testing. (Module 5)
Satisfied: The result when evidence shows a requirement is met. (Module 5)
Scenario pack: The fictional documents and evidence a capstone is based on. (Module 10)
Scheduled completion date: The original due date of a POA&M entry, which is not changed. (Module 7)
Scoping consideration: A fact about a system that makes a control, or part of one, inapplicable. (Module 3)
Secondary use: Use of customer data for a purpose other than providing the service. (Module 8)
Section 889: A statutory prohibition on certain telecommunications and video surveillance equipment and services. (Module 8)
Secure Software Development Framework (SSDF): NIST's set of practices for developing software securely. (Module 8)
Security assessment plan (SAP): The assessor's plan stating what will be tested and how. (Module 5)
Security assessment report (SAR): The assessor's record of what was tested and found. (Module 2)
Security impact analysis (SIA): Analysis of how a proposed change affects security and privacy, done before the change. (Module 7)
Security operations center (SOC): The team that watches for and responds to security events. (Module 7)
Security posture: The current overall security state of a system. (Module 7)
Self-attestation: A vendor's own unverified statement about its security. (Module 8)
Service account: An account used by software, not by a person. (Module 0)
Setpoint: The target value a controller tries to maintain. (Elective E1)
Shared responsibility model: The division of security duties between a cloud provider and its customer. (Module 0)
SIEM: Security information and event management: a system that collects and analyzes logs. (Module 0)
Significant change: A change likely to affect security or privacy enough to need the authorizing official's attention. (Module 7)
Silent failure: An automated job stopping without anyone noticing. (Elective E2)
Single point of knowledge: Dependence on one person who understands a system. (Elective E2)
SOC 2 report: A commercial audit report on a service provider's controls; supporting evidence only in a federal context. (Module 5)
Software as a Service (SaaS): The provider supplies a complete application. (Module 8)
Software bill of materials (SBOM): A machine-readable list of the components in a piece of software. (Module 8)
Special Publication (SP): A NIST guidance document, such as those in the SP 800 series. (Module 1)
Spot check: A manual check of a sample of automated results. (Elective E2)
Standard change: A routine, pre-approved type of change. (Module 7)
Supplementing: Adding controls beyond the baseline in response to risk. (Module 3)
Supply chain risk: Risk that a product or service is compromised through the suppliers behind it. (Module 8)
Symmetric encryption: Cryptography in which one shared key both encrypts and decrypts. (Module 0)
System of records notice (SORN): A public notice required when records about individuals are retrieved by personal identifier. (Module 2)
System owner: The official responsible for a system throughout its life. (Module 1)
System security plan (SSP): The document describing a system and how each control is implemented. (Module 2)
System-specific control: A control implemented entirely by and for one system. (Module 3)
Tailoring: Adjusting a baseline to fit a system, with recorded rationale. (Module 3)
Telemetry: Data a system emits about its operation, including logs, metrics, and traces. (Module 9)
Terms and conditions: Requirements attached to an authorization that must be met for it to remain valid. (Module 6)
Third-party assessment organization (3PAO): An accredited independent assessor of cloud services. (Module 8)
Threat: Something that could cause harm. (Module 0)
Threat Hunting, Investigation, Response, and Forensics (THIRF): Using logs to search for, investigate, and reconstruct attacks. (Module 7)
Threat modeling: A structured way of asking what could go wrong at each element of a system. (Module 4)
TLS (Transport Layer Security): The protocol that encrypts traffic in transit; HTTPS is HTTP inside TLS. (Module 0)
Transition plan: The plan for closing gaps created by a change in categorization. (Elective E1)
Triage: A quick first sort to find what needs attention first. (Module 10)
Trust boundary: A line on a diagram marking where data moves between zones of different trust. (Module 4)
Version control: A system that records every change to files, who made it, and why. (Elective E2)
Virtual machine: A software-defined computer with its own operating system, running on a hypervisor. (Module 0)
Volatility: How often a control's state is likely to change. (Module 7)
VPN (virtual private network): An encrypted tunnel across an untrusted network. (Module 0)
Vulnerability: A weakness that a threat could exploit. (Module 0)
Zero Trust: A security approach in which no user, device, or request is trusted because of its network location. (Module 9)
Zero Trust architecture (ZTA): A design that applies Zero Trust principles. (Module 9)
Zone: A group of assets with similar security requirements. (Elective E1)