Repair actions are limited to minor electrical and/or mechanical improvements to enhance operation, maintenance, or reliability. They do not require an identification label, marking, or control but must be fully documented by changes to the maintenance manual. Reserve keying material Key held to satisfy unplanned needs. (See contingency key.) Residual risk Portion of risk remaining after security measures have been applied. Data left in storage after information processing operations are complete, but before Residue degaussing or overwriting has taken place. Method by which the reference monitor mediates accesses to an information system Resource encapsulation resource. Resource is protected and not directly accessible by a subject. Satisfies requirement for accurate auditing of resource usage. Possibility that a particular threat will adversely impact an information system by Risk exploiting a particular vulnerability. Risk analysis Examination of information to identify the risk to an information system. Process of analyzing threats to and vulnerabilities of an information system, and the potential impact resulting from the loss of information or capabilities of a system. This Risk assessment analysis is used as a basis for identifying appropriate and cost-effective security countermeasures. Difference between the minimum clearance or authorization of information system Risk index and the maximum sensitivity (e.g.; classification and categories) of data processed by the system. Process of managing risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system. It includes risk assessment; cost-benefit analysis; the selection, Risk management implementation, and assessment of security controls; and the formal authorization to operate the system. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations. (NIST Special Pub 800-53) S Safeguard 1. Protection included to counteract a known or expected condition.
Repair actions are limited to minor electrical and/or mechanical improvements to enhance operation, maintenance, or reliability. They do not require an identification label, marking, or control but must be fully documented by changes to the maintenance manual. Reserve keying material Key held to satisfy unplanned needs. (See contingency key.) Residual risk Portion of risk remaining after security measures have been applied. Residue Data left in storage after information processing operations are complete, but before degaussing or overwriting has taken place. Resource encapsulation Method by which the reference monitor mediates accesses to an information system resource. Resource is protected and not directly accessible by a subject. Satisfies requirement for accurate auditing of resource usage. Risk Possibility that a particular threat will adversely impact an information system by exploiting a particular vulnerability. Risk analysis Examination of information to identify the risk to an information system. Risk assessment Process of analyzing threats to and vulnerabilities of an information system, and the potential impact resulting from the loss of information or capabilities of a system. This analysis is used as a basis for identifying appropriate and cost-effective security countermeasures. Risk index Difference between the minimum clearance or authorization of information system and the maximum sensitivity (e.g.; classification and categories) of data processed by the system. Risk management Process of managing risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system. It includes risk assessment; cost-benefit analysis; the selection, implementation, and assessment of security controls; and the formal authorization to operate the system. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations. (NIST Special Pub 800-53) S Safeguard 1. Protection included to counteract a known or expected condition.
CISSP_Glossary_v1.1.docx