NIST.SP.800-37r2

NIST SP 800-37 Revision 2

A publication outlining the Risk Management Framework for Information Systems and Organizations, focusing on security and privacy.

Risk Management Framework (RMF)

A structured process for managing security and privacy risks within information systems and organizations.

Security Categorization

The process of categorizing information and information systems based on their requirement for confidentiality, integrity, and availability.

Common Control Provider

An individual or entity responsible for the implementation and oversight of controls that can be inherited by multiple information systems.

Authorization Boundary

The scope of protection for an information system, including all components that are subject to management control.

Continuous Monitoring

The ongoing awareness and management of the security and privacy posture of information systems.

Plan of Action and Milestones (POAM)

A document outlining tasks and timelines for addressing deficiencies in controls identified through assessments.

Privacy Impact Assessment (PIA)

An analysis that determines how an information system collects, uses, and protects personally identifiable information (PII).

Supply Chain Risk Management (SCRM)

Efforts to address risks arising from the procurement and use of systems and services from external suppliers.

Resilient Military Systems

Systems designed to withstand and recover from threats and vulnerabilities, particularly in the context of national security.