Glossary | IT Security Architect

Control baseline: A starting set of controls defined in NIST SP 800-53B for systems categorized as low, moderate or high impact, plus a separate privacy baseline. Organizations then tailor the baseline. This site reads baseline membership directly from NIST's machine-readable profiles.
Control enhancement: A statement that adds function or strength to a base control. Enhancements are written with the enhancement number in parentheses: AC-2(3) is the third enhancement of AC-2. Implementing an enhancement assumes the base control is implemented.
Controlled Unclassified Information (CUI): Information the U.S. government creates or possesses that law, regulation or government-wide policy requires to be safeguarded, but that is not classified. NIST SP 800-171 sets security requirements for protecting CUI in nonfederal systems.
CPRT: NIST's online tool for browsing and exporting reference data from its publications, including the CSF 2.0 informative references used on this site.
CSF subcategory: The most specific level of the NIST Cybersecurity Framework 2.0 core. Subcategories sit under categories (GV.OC) and functions (GOVERN). Identifiers look like GV.OC-01.
Data-flow diagram (DFD): A diagram that shows how data moves through a system using a small set of elements: external entities (interactors), processes, data stores and data flows. Threat modeling adds trust boundaries.
Informative reference: A mapping that shows how an element of another document (for example an SP 800-53 control) relates to a CSF 2.0 subcategory. NIST publishes these through its Cybersecurity and Privacy Reference Tool. A mapping shows a relationship; it is not evidence that a control is implemented.
NICE Framework work role: The Workforce Framework for Cybersecurity (NICE Framework) describes cybersecurity work as work roles made up of tasks, knowledge and skills. CISA publishes a Security Architect work role page with code 652 and its associated tasks.
Organization-defined parameter (ODP): A placeholder inside a control statement that the organization fills in, such as the period of inactivity after which accounts are disabled. On this site these appear as [Assignment: ...] or [Selection: ...] in control text.
OSCAL: A set of formats (JSON, XML, YAML) published by NIST for expressing control catalogs, baselines and assessment information in machine-readable form. This site's control data is built from NIST's OSCAL releases.
RTO and RPO: The recovery time objective is how long a function may be unavailable; the recovery point objective is how much data, measured in time, may be lost. Both are inputs to architecture, not only to operations.
Security categorization: The process of determining the potential impact on the organization if the confidentiality, integrity or availability of a system's information is compromised. The result drives which control baseline applies. SP 800-53 addresses it in RA-2.
Security control (SP 800-53): A safeguard or countermeasure in the NIST SP 800-53 catalog. Each control has an identifier made of a two-letter family code and a number (AC-2 is Account Management in the Access Control family), a statement of what must be done, and discussion text.
Shared responsibility model: The division of security tasks between a cloud service provider and the customer. The split differs by service type; the provider's documentation is the authority for each service.
Software bill of materials (SBOM): A formal, machine-readable inventory of the components, libraries and dependencies used to build software. It supports provenance and vulnerability tracking.
STRIDE: A threat classification developed at Microsoft. Each category is the violation of a security property: spoofing of authentication, tampering of integrity, repudiation of non-repudiation, information disclosure of confidentiality, denial of service of availability, and elevation of privilege of authorization.
System security plan (SSP): A formal document that describes the system boundary, operating environment and how each required control or requirement is implemented. SP 800-53 addresses it in PL-2; SP 800-171 Rev. 3 has a corresponding requirement.
Threat model: The Threat Modeling Manifesto defines threat modeling as analyzing representations of a system to highlight concerns about security and privacy characteristics. In practice: a diagram, a list of what can go wrong, and decisions about each item.
Trust boundary: A boundary on a data-flow diagram where the level of trust changes, for example between the internet and an API gateway, or between an application and a third-party service. Flows that cross a trust boundary deserve the most scrutiny.
Withdrawn control: A control or enhancement that has been removed, usually because it was incorporated into another control. Withdrawn entries keep their identifiers so numbering stays stable. Tools on this site never map to withdrawn controls.