Glossary

A

Acceptable Use

The authorized and appropriate use of State IT resources, as defined by this policy and agency rules. Source: aligns with NIST SP 800-53 Rev. 5 PL-4.

Access Agreement

A signed acknowledgement, such as a nondisclosure agreement, acceptable use agreement, or rules of behavior, in which an individual agrees to abide by the constraints tied to the systems they are authorized to access. Source: aligns with NIST SP 800-53 Rev. 5 PS-6.

Access Control

The process of granting or denying specific requests to 1) obtain and use information and related information processing services and 2) enter specific physical facilities (e.g., federal buildings, military establishments, border crossing entrances). [Source: FIPS 201-3]

Accessibility Conformance Report (ACR)

A vendor-supplied report, based on the VPAT format, documenting how a specific product conforms to accessibility standards.

Accessibility Officer

The agency staff member designated to lead and coordinate the agency's digital accessibility compliance.

Account Manager

An individual or role responsible for establishing, activating, modifying, reviewing, disabling, and removing information system accounts, including enforcement of account approval and periodic privilege-review requirements. [Source: Aligns with NIST SP 800-53 Rev. 5, AC-2]

Administrator Account

An account with full/elevated privileges on a computer/device, system, or application.

Algorithm

A clearly specified mathematical process for computation derived from a set of rules that, if followed, will give a prescribed result. [Source: NIST SP 800-107 Rev. 1]

Alternate Processing Site

A site geographically distinct from the primary processing site that provides processing capability when the primary processing site is unavailable. Source: NIST SP 800-53 Rev. 5, CP-7 discussion.

Alternate Storage Site

A site geographically distinct from the primary storage site that holds duplicate copies of information and data for use when the primary storage site is unavailable. Source: NIST SP 800-53 Rev. 5, CP-6 discussion.

Alternate Work Site

A location other than the primary facility, such as a government facility or an employee residence, from which workforce members conduct State work; distinct from an alternate processing site. Source: aligns with NIST SP 800-53 Rev. 5 PE-17.

Approved Hardware (End User Device) List

A documented and vetted list of models and specifications for end user devices that meet the enterprise's performance, security, and supportability criteria.

Artificial Intelligence (AI)

Technologies that encompass a variety of techniques and approaches, such as machine learning, natural language processing, computer vision, and robotics, aimed at enabling machines to perform tasks that typically require human intelligence. For the sake of clarity, AI does not include traditional data science activities or robotic process automation.

Auditable Event

A system activity that has been selected to be recorded in an audit log because it matters for security, accountability, or compliance. Source: aligns with NIST SP 800-53 Rev. 5 AU-2.

Audit Log

A chronological record of system activities. Includes records of system access and operations performed in a given period. [Source: CNSSI 4009-2015]

Audit Trail

A record showing who has accessed an information technology (IT) system and what operations the user has performed during a given period, including a chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security relevant transaction from inception to final result. [Source: CNSSI 4009-2015]

Authentication

The process of verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system. This process ensures that someone's identity or the validity of something to ensure that only authorized users can access information, systems, or other resources. [Source: NIST SP 800-53 Rev. 5]

Authenticator

Something a user, device, or service presents to prove identity — such as a password, cryptographic key, security token, or biometric. Source: aligns with NIST SP 800-53 Rev. 5 IA-5.

Authoritative Time Source

A trusted, traceable source of time — mappable to Coordinated Universal Time (UTC) — used to synchronize system clocks for accurate audit timestamps. Source: aligns with NIST SP 800-53 Rev. 5 AU-8.

Authorization

The right or permission (access privileges) that is granted to a user, program, or process (system entity) to access a system. [Source: NIST SP 800-82r3]

Authorization to Operation (ATO)

The official management decision given by a senior official to authorize operation of a system or the common controls inherited by designated organizations systems and to explicitly accept the risk to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security and privacy controls. Also known as authorization to operate. [Source: NIST SP 800-12 Rev. 1]

Authorized Submitter

A role in the enterprise information technology service management system (ITSM), ServiceDesk Plus, that grants an individual the ability to submit restricted-category requests to the DOM DoIT Information Security Bureau on behalf of their entity.

Authorizing Official

A senior official with the authority to authorize a system to operate and to accept the risk to organizational operations, assets, and individuals. Source: aligns with NIST SP 800-37 Rev. 2.

Availability

Ensuring timely and reliable access to and use of information. [Source: CNSSI 4009-2015 from 44 U.S.C., Sec. 3542(b)(1)(c)]

B

Baseline Configurations

A documented set of specifications for an information system, or a configuration item within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures. Baseline configurations establish a known and secure state for an information system and serve as the foundation for future builds, updates, and configuration changes. [Source: CNSSI 4009-2015]

Baseline Tailoring

The process of customizing a selected control baseline by adding, removing, or modifying controls to fit a system's mission, environment, and risk. Source: aligns with NIST SP 800-53 Rev. 5 PL-11.

Biometric Data

Biological attribute of an individual from which distinctive and repeatable values can be extracted for the purpose of automated recognition. Fingerprint ridge structure and face topography are examples of biometric characteristics. [Source: FIPS 201-3 from ISO/IEC 2382-37;2017]

Boundary Protection

Monitoring and control of communications at the external and key internal boundaries of a system using managed interfaces such as gateways, routers, firewalls, and encrypted tunnels. Source: NIST SP 800-53 Rev. 5, SC-7.

Breach

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users, or where authorized users take actions for an other than authorized purposes, have access or potential access to sensitive information, whether physical or electronic. [Source: NIST SP 800-175A]

Bring Your Own Device (BYOD)

The use of a personally owned device to access or store State information or connect to State networks. Source: aligns with NIST SP 800-53 Rev. 5 AC-20.

Bring Your Own Device (BYOD) / Personally Owned Device

A device owned by an individual rather than the State that is used to access, store, transmit, or process State of Iowa information or systems. Source: aligns with NIST SP 800-53 Rev. 5 AC-19/AC-20.

Business Associate

Any person or organization (not part of a covered entity’s workforce) that performs functions or activities on behalf of a covered entity involving the creation, receipt, maintenance, or transmission of protected health information (PHI), or that provides certain services to a covered entity that involve PHI disclosure. Source: U.S. Department of Health and Human Services

Business Associate Agreement (BAA)

A Business Associate Agreement is the written contract requiring the associate to safeguard PHI. Source: 45 CFR §160.103; §164.314(a).

Business Continuity

The capability of an organization to keep essential mission and business functions running, or to resume them quickly, during and after a disruption. Source: aligns with NIST SP 800-34 Rev. 1.

Business Impact Analysis (BIA)

An analysis that identifies and prioritizes system components by correlating them to the mission and business functions they support, and that characterizes the consequences of a disruption. Source: NIST SP 800-34 Rev. 1.

C

Central NDA Registry

The single, authoritative log of all executed vendor NDAs maintained by DOM

Certificate Authority

A trusted entity that issues and revokes public key certificates. [Source: NISTIR 8149]

Certificate Revocation List (CRL)

A list of revoked public key certificates created and digitally signed by a Certification Authority. Source: NIST SP 800-57 Part 1 Rev. 5 / CNSSI 4009-2015

Change Advisory Board (CAB)

A formally designated group of stakeholders responsible for reviewing, approving, and prioritizing changes to configuration items (e.g., hardware, software, firmware), and documentation throughout the development and operational life cycle of an information system. CABs may be organized into multiple tiers based on impact and scope. [Source: NIST SP 800-128]

Change Control Database (CCDB)

The system of record used to document, track, and manage configuration changes and associated approvals throughout the system lifecycle.

Change Management

The systematic proposal, justification, implementation, testing, review, and disposition of system changes, including upgrades and modifications. It involves managing and monitoring configurations of information systems to achieve adequate security and minimize organizational risk while supporting business functionality.

Change Manager

Designated role responsible for overseeing the change management process, including coordination of CAB activities and enforcement of baseline risk requirements compliance.

Common Control

A control that is inherited by one or more organizational systems rather than implemented separately by each system. Source: NIST SP 800-53 Rev. 5 glossary.

Computer Matching

The computerized comparison of records from two or more automated systems of records to identify individuals for a specific purpose, subject to privacy safeguards where a covered program applies. Source: aligns with NIST SP 800-53 Rev. 5 PT-8 and the Computer Matching and Privacy Protection Act.

Computer Security Incident Response Plan (CSIRP)

The enterprise plan describing the approach, structure, roles, and procedures for detecting, reporting, and responding to incidents. Source: aligns with NIST SP 800-53 Rev. 5 IR-8.

Confidentiality

Preserving unauthorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [Source: FIPS under 'confidentiality' from 44 U.S.C., Sec. 3542]

Configuration Item

Any component of an information system, including hardware, software, documentation, or service, treated as a single entity and that is subject to configuration management and change control. [Source: CNSSI 4009-2015]

Configuration Management Plan (CMP)

A comprehensive plan providing guidelines for establishing, maintaining, and monitoring secure configurations of information systems to enhance security and minimize risks. [Source: NIST SP 800-128]

Configuration Settings

The adjustable parameters of a system's hardware, software, or firmware that affect its security, privacy, or functionality. Source: aligns with NIST SP 800-53 Rev. 5 CM-6.

Consent (Privacy)

An individual's informed, voluntary agreement to a described processing of their PII, where consent is the legal basis for that processing. Source: aligns with NIST SP 800-53 Rev. 5 PT-4.

Containerization

A method that isolates State of Iowa information and applications in a separate, secured space on a device, keeping them apart from personal data.

Content Management System (CMS)

A software system that provides website authoring, collaboration, and administration tools enabling an organization to create, edit, review, and publish electronic content to the web.

Contingency Plan

A written plan used to guide an enterprise response to a perceived loss of mission capability. The contingency plan is the first plan used by the enterprise risk managers to determine what happened, why, and what to do. It may point to the continuity of operations plan (COOP) or disaster recovery plan (DRP) for major disruptions. [Source: CNSSI 4009-2015]

Continuous Monitoring

Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. This includes the use of automated procedures to ensure security controls are not circumvented or the use of these tools to track actions taken by subjects suspected of misusing the information system. [Source: CNSSI 4009-2015 from NIST SP 800-137]

Continuous Monitoring Strategy

A documented approach for maintaining ongoing awareness of security and privacy posture, defining the metrics to monitor and the frequencies for monitoring and control assessment. Source: aligns with NIST SP 800-137.

Control Assessment

The testing or evaluation of controls in a system to determine whether they are implemented correctly, operating as intended, and producing the desired outcome. Source: NIST SP 800-53 Rev. 5, CA-2.

Control Assessment Plan

A plan describing the scope of a control assessment, including the controls under assessment, the assessment procedures, and the assessment environment, team, and roles. Source: NIST SP 800-53 Rev. 5, CA-2 discussion.

Control Baseline

A predefined set of controls assembled to address the protection needs of systems at a given impact level, serving as the starting point for control selection. Source: aligns with NIST SP 800-53 Rev. 5 PL-10 and SP 800-53B.

Controlled Area

A space for which the organization provides physical or procedural controls to meet the requirements established for protecting information and systems. Source: NIST SP 800-53 Rev. 5, MP-4/MP-5 discussion.

Controlled Maintenance

Scheduled, approved, and documented maintenance and repair of system components, performed in line with vendor specifications and enterprise procedures. Source: aligns with NIST SP 800-53 Rev. 5 MA-2.

CONUS

Continental United States (CONUS): The 48 contiguous states and the District of Columbia.

Counterfeit Component

A component misrepresented as genuine, including unauthorized copies, substitutes, or used parts sold as new. Source: aligns with NIST SP 800-53 Rev. 5 SR-11.

Covered Entity

A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction. Source: 45 CFR §160.103.

Criticality Analysis

The identification of critical system components and functions by analyzing how a system fails and the effect of that failure on supported mission and business functions. Source: NIST SP 800-53 Rev. 5, RA-9.

Critical Procurement

A procurement of technology, components, systems, or services whose loss, compromise, or foreign-adversary control would materially harm State operations, critical infrastructure, or public safety. Source: aligns with NIST SP 800-161 and RA-9.

Cryptographic Erase

A media sanitization method that renders information unrecoverable by securely deleting the cryptographic keys used to encrypt the stored data. Source: aligns with NIST SP 800-88 Rev. 1.

CyberGUARD

A State of Iowa enterprise information security program that encompasses a variety of risk products, including the establishment of baseline risk requirements, policies, procedures, directives, and other risk-related documents. CyberGUARD stands for Cyber Governance, Understanding, Assessment, and Risk Directive. The programs intent is to provide a robust framework or resources for managing cybersecurity risks across the enterprise.

D

Data

A subset of information in an electronic format that allows it to be retrieved or transmitted. [Source: NIST SP 1800-10]

Demilitarized Zone (DMZ)

A subnetwork, physically or logically separated from internal networks, that hosts publicly accessible system components. Source: NIST SP 800-53 Rev. 5, SC-7 discussion.

Denial-of-Service (DoS)

An event, often an attack, that prevents authorized access to a system or degrades its operation by exhausting capacity or bandwidth. Source: aligns with NIST SP 800-53 Rev. 5, SC-5.

Developer

An entity — internal or external — that designs, develops, or maintains a system, system component, or system service for the organization. Source: NIST SP 800-53 Rev. 5 glossary.

Digital Certificate

A set of data that uniquely identifies a public key that has a corresponding private key and an owner that is authorized to use the key pair. The certificate contains the owner's public key and possibly other information and is digitally signed by a certification authority (i.e., a trusted party), thereby binding the public key to the owner. [Source: FIPS 204]

Digital Content and Services

Any content or capability the State provides or uses in electronic form, including websites, web applications, mobile applications, and electronic documents.

Digital Service

Any public-facing online capability the State provides, including websites, web applications, portals, mobile applications, and application programming interfaces.

Digital Signature

A digital representation of a signature that provides assurance of the origin, authenticity, and integrity of the data. It is generated through a cryptographic transformation and is used to verify the identity of the signer and ensure that the information has not been altered. [Source: FIPS 186-5 under 'digital signature']

DNS Security Extensions (DNSSEC)

A set of extensions that add data origin authentication and integrity verification to Domain Name System responses. Source: aligns with NIST SP 800-53 Rev. 5, SC-20/SC-21.

DOM

The Iowa Department of Management.

DOM Workers

All employees, contractors, vendors, interns, board members, and any individual working for the Iowa Department of Management (DOM) who has access to State of Iowa-managed systems, data, or information. This also includes anyone who does IT work or works with Criminal Justice Information (CJI) for DOM even if they don't otherwise work for DOM. These individuals must follow any additional requirements for IT or CJI work, along with the general requirements for DOM Workers.

Draft Information Security Policy

High-level statement establishing minimum requirements for decision-making and behavior. Internal only and not enforceable. Requires review and approval to proceed to another policy state – interim or final.

Due Care

The reasonable steps or action an organization takes to protect its information assets from unauthorized access, use, disclosure, modification, or destruction. It involves implementing necessary precautions to ensure compliance with industry best practices and maintaining a robust cybersecurity posture. Key aspects of due care include establishing comprehensive information security policies, conducting regular audits, and providing ongoing cybersecurity training for employees. [Source: NIST SP 1326]

Due Diligence

The practice of taking reasonable, risk-based measures to safeguard an organization's assets, information, finances, and reputation. It involves proactively identifying, assessing, and mitigating risks to ensure compliance with applicable laws, regulations, and standards (e.g., NIST, federal mandates). Due diligence encompasses implementing appropriate security controls, validating third-party relationships, and maintaining continuous oversight to protect confidentiality, integrity, and availability of systems and information. It reflects a commitment to responsible stewardship and accountability in managing public resources and trust. [Source: Aligns with NIST RMF and FISMA]

E

Electronic Document

An electronic file intended to be read or used by people, such as a PDF, word-processing file, spreadsheet, or presentation.

Electronic Protected Health Information (ePHI)

Protected health information that a covered entity or business associate creates, receives, maintains, or transmits in electronic form. Source: 45 CFR §160.103; §164.304.

Elevated Credential Safe

The enterprise system through which elevated credentials are issued on a checkout (password-checker) basis, with each grant managed as a temporary, permanent, or just-in-time exception.

Elevated / System-Administrator Privileges

Privileges that let the holder change the security of the environment itself — for example, enabling or disabling logging, exercising domain-wide or equivalent “administrator-of-administrators” control, or managing authentication and multi-factor authentication systems. Described by capability rather than product. Source: aligns with NIST SP 800-53 Rev. 5 AC-6.

Emergency Configuration Change

A configuration change that must be implemented urgently to address critical issues such as security incidents or outages, following an expedited approval process and post-implementation review.

Encryption

Cryptographic transformation of data (called "plaintext") into a form (called "ciphertext") that conceals the data's original meaning to prevent it from being known or used. If the transformation is reversible, the corresponding reversal process is called "decryption," which is a transformation that restores encrypted data to its original state. [Source: NIST SP 800-82r3 under Encryption from RFC 4949 - adapted]

End-User Device

Tangible computing devices designed for individual users to interact with, capable of storing data, and connecting to networks.

Enterprise Approved Hardware List

A documented and vetted list of hardware authorized for purchase, deployment, connection, or use on or with State of Iowa-managed systems and networks, maintained by the enterprise hardware approval function in a central system of record. Note: the Definitions document already defines a narrower “Approved Hardware (End User Device) List”; recommend reconciling the two so the end-user-device list is the end-user-device portion of this broader list. Source: derived from NIST SP 800-53 Rev. 5 CM-8.

Enterprise Approved Software List

A documented and vetted list of software authorized for installation and use on State of Iowa-managed information systems, maintained by the enterprise software approval function in a central system of record accessible to all Enterprise Workers. Source: derived from NIST SP 800-53 Rev. 5 CM-10.

Enterprise Architecture

The organization-wide description of business processes, information, and technology that guides how systems and their security and privacy architectures are designed. Source: aligns with NIST SP 800-53 Rev. 5 PM-7.

Enterprise Technology Officer (ETO)

A DOM liaison to assigned Supported Entities who is informed of relevant incidents but holds no incident ownership or decision authority.

Enterprise Workers

All employees, contractors, vendors, interns, board members, and any individual working for the Iowa Department of Management (DOM) or any Supported Entity (Iowa Code Chapter 8) who has access to State of Iowa-managed systems, data, or information. This also includes anyone who does IT work or works with Criminal Justice Information (CJI) for DOM or a Supported Entity, even if they don't otherwise work for DOM or a Supported Entity. These individuals must follow any additional requirements for IT or CJI work, along with the general requirements for Enterprise Workers.

Error Handling

The way a system generates and displays error messages so that they support correction without exposing exploitable information. Source: aligns with NIST SP 800-53 Rev. 5 SI-11.

Essential Mission and Business Functions

The subset of organizational functions that will be continued or rapidly resumed during a disruption to avoid unacceptable harm to the organization's mission. Source: NIST SP 800-34 Rev. 1.

External Provider

An organization other than the State of Iowa that operates or supports a State system or provides a service, including service bureaus, contractors, and outsourced or managed-service organizations. Source: aligns with NIST SP 800-53 Rev. 5 PS-7 and SA-9.

External System

An information system that DOM does not directly own, operate, or control — including personally owned devices, contractor systems, and third-party cloud services. Source: aligns with NIST SP 800-53 Rev. 5 AC-20.

External System Service

A system service provided by an external provider over which the organization has no direct control of the implementation or the assessment of control effectiveness. Source: NIST SP 800-53 Rev. 5, SA-9.

F

Final Information Security Policy

Long-term strategy establishing minimum requirements for decision-making and behavior. Enforceable. Requires review and approval.

Firewall

A gateway that limits access between networks in accordance with local security policy. [Source: CNSSI 4009-2015]

Flaw Remediation

The process of identifying, reporting, testing, and correcting weaknesses in software and firmware, including installing patches and updates. Source: aligns with NIST SP 800-53 Rev. 5 SI-2.

Foreign Adversary

A foreign government or non-government person determined to have engaged in conduct adverse to U.S. national security or the security and safety of U.S. persons, as identified under 15 C.F.R. § 791.4. Source: 15 C.F.R. § 791.4.

Foreign Ownership, Control, or Influence (FOCI)

A condition in which a foreign interest has the power to direct or decide matters affecting a supplier, which may create supply chain risk. Source: aligns with NIST SP 800-53 Rev. 5 SR-6.

Foundational Information Security and Privacy Awareness and Training

The purpose of this type of training is for the participant to gain a basic understanding of the need for information security and privacy and the actions that the individual can take to maintain security and privacy and respond to suspected incidents. This training also increases awareness regarding the importance of operations security.

G

Generative Artificial Intelligence

A type of Artificial Intelligence that generates content such as text, images, audio, and video. [Source: NIST SP 800-218A]

H

Hardened Token

A security token that is physically secure and difficult to replicate or bypass. Generally, they are hardware devices that utilize encryption algorithms and can include features like biometrics or secure PINs to complete two-factor authentication (2FA) or multi-factor authentication (MFA). [Source: NIST SP 800-63-1]

Hybrid Entity

A single legal entity that performs both covered and non-covered duties and designates its health care components. Source: 45 CFR §164.103; §164.105.

I

Identification

The process of discovering the identity of a person or item from a collection of similar entities. It involves verifying the identity of a user, process, or device which is crucial for granting access to resources in an IT system. Identification is part of a broader framework that includes authentication, which verifies the validity of the claimed identity. [Source: CNSSI 4009-2015 NIST SP 800-79-2 under Identification]

Identifier

A unique name or code assigned to an individual, group, role, service, or device so that actions can be attributed to it. Source: aligns with NIST SP 800-53 Rev. 5 IA-4.

Identity Assurance Level

The degree of confidence in a claimed identity, used to calibrate how rigorous identity proofing must be for a given system. Source: aligns with NIST SP 800-63-3.

Identity Proofing

The process of collecting, validating, and verifying a user's identity information before establishing credentials for system access. Source: aligns with NIST SP 800-53 Rev. 5 IA-12 and NIST SP 800-63A.

Impact Level

The magnitude of harm (low, moderate, or high) that could result from a loss of confidentiality, integrity, or availability of a system or its information. Source: FIPS 199.

Incident

An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation: of security policies, security procedures, or acceptable use policies. [Source: FIPS 200 under 'incident']

Incident Response Coordinator (IRC)

The Supported Entity's designated business contact for incident response, responsible for communication and incident records.

Independent Energy Source

An energy source, such as a microgrid, that is separate or can be separated from the sources powering the rest of a facility, used to support fire detection and suppression. Source: aligns with NIST SP 800-53 Rev. 5 PE-13.

Information

Any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual. An instance of an information type. [Source: NIST SP 800-31 Rev 1 under 'information' from CNSSI 4009, FIPS 199]

Information at Rest

The state of information when it is not in process or in transit and is stored on system components such as drives, storage devices, or databases. Source: NIST SP 800-53 Rev. 5, SC-28.

Information (Data) Custodian

A technical role, assigned to an individual or team, rooted in IT operations. Custodians are responsible for the secure storage, protection, and technical integrity of information assets. Their duties include implementing and maintaining infrastructure (databases, storage systems), enforcing security and privacy controls (encryption, access management, logging), managing backups, and ensuring compliance with regulatory frameworks such as NIST, GDPR, CCPA, and FISMA. They focus on availability, confidentiality, and integrity at the system level, serving as the technical foundation for data governance. [Source: Definition based on industry standards, specifically NIST and FISMA]

Information (Data) Owner

Official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. [Source: CNSSI 4009]

Information (Data) Steward

Individual or team responsible for the management and oversight of information. Stewards are focused on the quality, usability, and governance of data. Stewards define and enforce business rules, maintain metadata, and ensure data accuracy, completeness, and consistency across systems. They document data for accessibility, set access policies aligned with organizational objectives, and collaborate with custodians to balance compliance with business value. Their goal is to transform data into a strategic asset that supports decision-making and regulatory adherence. [Source: CNSSI 4009 and NIST industry standards]

Information Flow Enforcement

Controls that govern where information may travel between systems, network segments, or security zones, independent of who is accessing it. Source: aligns with NIST SP 800-53 Rev. 5 AC-4.

Information Input Validation

Checking that data entered into a system matches the expected format, type, range, and content before it is processed. Source: aligns with NIST SP 800-53 Rev. 5 SI-10.

Information Location

Knowledge of where specific information types are processed and stored across system components, used to apply protection consistently. Source: aligns with NIST SP 800-53 Rev. 5 CM-12.

Information Privacy

The safeguarding of human autonomy and dignity through various means, including confidentiality, predictability, manageability, and disassociability. [Source: NIST SP 800-50r1]

Information Retention

Keeping information for a defined period to meet legal, regulatory, and operational requirements before disposal. Source: aligns with NIST SP 800-53 Rev. 5 SI-12.

Information Security

The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. [Source: FIPS 200 under 'information security' from 44 U.S.C., Sec. 3542]

Information Spillage

Security incident that results in the transfer of classified information onto an information system not authorized to store or process that information. [Source: CNSSI 4009-2015 under 'classified information spillage']

Information System

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [Source: FIPS 200 under 'information system' from 44 U.S.C., Sec. 3502]

Information System Owner

Official responsible for the overall procurement, development, integration, modification, operation, and maintenance of an information system, and for the security posture of that system. [Source: Aligns with NIST SP 800-18 Rev.1/CNSSI 4009]

Information Technology (IT) Resources

Collectively includes data, information, information systems, technology, and resources.

Insider Threat

The risk that a current or former workforce member, wittingly or unwittingly, causes harm to State information or systems. Source: aligns with NIST SP 800-53 Rev. 5 AT-2(2).

Integrity

Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity. [Source: NIST SP 800-59 under 'integrity' from 44 U.S.C., Sec. 3542(b)(1)(A)]

Interconnection Security Agreement

A formal agreement between the owners of connected systems that documents the technical and security requirements of the interconnection. Source: aligns with NIST SP 800-47 Rev. 1.

Interim Information Security Policy

High-level statement establishing minimum requirements with transitional steps toward a final policy. Enforceable. Requires review and approval.

Internal System Connection

A connection between a system and its own constituent components, such as connections to mobile devices, printers, scanners, sensors, or servers. Source: NIST SP 800-53 Rev. 5, CA-9.

Iowa Statistical Analysis Center (SAC)

Iowa Code sec. 8.98 establishes the Iowa Statistical Analysis Center (SAC), which is Iowa's state-level unit that uses criminal and juvenile justice data to conduct objective, policy-relevant research. There are currently SACs in 53 States and territories.

J

Just-In-Time (JIT) Access

Granting privileged access only for the limited time and scope needed to complete a task, then automatically removing it. Source: aligns with NIST SP 800-53 Rev. 5 AC-6.

L

Large Language Model (LLM)

A type of generative AI trained on large text datasets to understand and produce human-like language. Source: aligns with the CyberGUARD definition of Generative Artificial Intelligence.

Least Functionality

The principle of configuring a system to provide only the capabilities needed for its mission and disabling or removing all others. Source: aligns with NIST SP 800-53 Rev. 5 CM-7.

Legal Hold

A requirement to preserve records that may be relevant to litigation, an investigation, or an audit, overriding normal retention and disposal.

Local Logon

Access to an organizational system by a user (or process acting on behalf of a user) through a direct connection without the use of a network. This means that the user is accessing the system directly, without going through any intermediary network. [Source: CNSSI 4009-2015]

M

Maintenance Tools

Hardware, software, or media used to service, diagnose, or repair a system, which will be approved, controlled, and inspected before use. Source: aligns with NIST SP 800-53 Rev. 5 MA-3.

Malicious Code

Software or firmware intended to perform an unauthorized process that will have adverse impacts on the confidentiality, integrity, or availability of a system. A virus, worm, Trojan horse, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code. [Source: NIST SP 800-53 Rev. 5]

Malware

Hardware, firmware, or software that is intentionally included or inserted in a system for a harmful purpose. [Source: CNSSI 4009-2015]

Managed End-User Device

Any physical or virtual device used to access State systems or information that is enrolled in, and secured by, the enterprise UEM solution. Source: aligns with the CyberGUARD definition of End-User Device and NIST SP 800-53 Rev. 5 CM-8.

Managed Interface

A boundary point that controls communications between a system and external networks using boundary protection devices arranged per the security architecture. Source: NIST SP 800-53 Rev. 5, SC-7 discussion.

Memory Protection

Controls that prevent unauthorized code from executing in system memory, such as data execution prevention and address space layout randomization. Source: aligns with NIST SP 800-53 Rev. 5 SI-16.

Mobile Application

An application delivered as a downloadable or installable application on a mobile device.

Mobile Application Management (MAM)

A solution that manages and secures specific applications and their data on a device, rather than the entire device.

Mobile Code

Any program, application, or content that can be transmitted across a network and executed on a remote system, such as Java applets, JavaScript, or HTML5. Source: NIST SP 800-53 Rev. 5, SC-18.

Mobile Device Management (MDM)

A centrally managed solution that enforces security settings, policies, and remote actions (such as wipe) on managed mobile devices.

Multi-Factor Authentication (MFA)

Authentication using two or more factors to achieve authentication. Factors include: (i) something you know (e.g., password/personal identification number (PIN)); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). [Source: CNSSI 4009-2015 under 'multifactor authentication']

N

Nondisclosure Agreement

A written agreement under which DOM commits to treat specified vendor information as confidential.

Non-Local Logon

The process of logging into a system or application where authentication occurs via a networked system, such as a domain controller, cloud-based authentication provider, or VPN. This includes remote logons and on-premise authentication to shared resources that require verification from an external identity service.

Non-Local Maintenance

Maintenance activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. [Source: CNSSI 4009-2015]

Non-Repudiation

A service that is used to provide assurance of the integrity and origin of information in such a way that the integrity and origin can be verified and validated by a third party as having originated from a specific entity in possession of the private key (e.g., the signatory). [Source: FIPS 186-5 under 'non-repudiation']

Notice

A public statement an agency publishes on its digital assets, such as an Accessibility Statement, Privacy Statement, Terms of Use, Non-Discrimination and Accommodation notice, or Contact Information.

O

OCONUS

Outside the Continental United States (OCONUS): Any location that is not one of the 48 contiguous states or the District of Columbia.

Other Digital Service

A digital service that is neither a website nor a web application.

P

Password Vault

A secured system that stores, controls, and rotates privileged credentials and supports temporary, audited access provisioning.

Patch Management

The systematic notification, identification, deployment, installation, and verification of operating system and application software code revisions. These revisions are known as patches, hot fixes, and service packs. [Source: CNSSI 4009-2015]

Personal Identity Verification (PIV)

A standardized government credential and process for verifying the identity of individuals, using products validated against FIPS 201. Source: FIPS 201-3.

Personal Identity Verification (PIV) Credential

A standardized, federally issued credential used to electronically verify identity. Source: aligns with FIPS 201-3.

Personally Identifiable Information (PII)

Information that can be used to distinguish or trace an individual's identity – such as name, social security number, biometric data records – either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual (e.g., date and place of birth, mother's maiden name, etc.). [Source: FIPS 201-3 under 'personally identifiable information (PII)' from OMB M-17-12- adapted]

Personnel Sanctions

A formal, consistent process for responding to a workforce member's failure to comply with information security and privacy policies and procedures, coordinated with human resources and legal counsel. Source: aligns with NIST SP 800-53 Rev. 5 PS-8.

Personnel Screening

The process of verifying, before access is granted and periodically thereafter, that an individual meets the trustworthiness expectations of their position, such as through background investigations and agency checks. Source: aligns with NIST SP 800-53 Rev. 5 PS-3. Detailed standards reside in the Background Investigation Policy.

Phishing

A technique for attempting to acquire sensitive information and data, such as bank account numbers, through a fraudulent solicitation in email or on a web site, in which the perpetrator masquerades as a legitimate business or reputable person. [Source: CNSSI 4009-2015]

Physical Access Device

A physical mechanism used to control entry, such as a key, lock, combination, badge reader, card reader, or biometric reader. Source: aligns with NIST SP 800-53 Rev. 5 PE-3.

Planned Configuration Change

A non-emergency change that requires formal assessment, scheduling, review, and approval prior to implementation.

Plan of Action and Milestones (POA&M)

(1) A document that identifies weaknesses, the planned actions to correct them, the resources required, and the milestones and completion dates. Source: NIST SP 800-53 Rev. 5, CA-5. | (2) A document that identifies control weaknesses, the planned actions to correct them, the resources required, and the milestones and dates for completion. Source: NIST SP 800-53 Rev. 5, CA-5.

Policy

Statements, rules or assertions that specify the correct or expected behavior of an entity. Policy defines what must be done and sets clear goals, acceptable behaviors, and minimum risk thresholds for workforce members. [Source: NIST SP 800-95 from Open Grid Services Architecture Glossary of Terms]

Position Risk Designation

A rating assigned to a position that reflects the potential harm to the efficiency or integrity of State service from misuse of the position, and that sets the level of screening required. Source: aligns with NIST SP 800-53 Rev. 5 PS-2 and U.S. OPM Position Designation System.

Pre-authorized Configuration Change (Standard)

A low-risk, well-understood change that has a predefined process for implementation and does not require full CAB review for approval.

Principle of Least Privilege (PoLP)

A security principle that a system should restrict the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks. [Source: NIST SP 800-53, Rev 5 from CNSSI 4009-2015]

Privacy Impact Assessment (PIA)

An analysis of how PII is collected, used, shared, and maintained in a system, and of the privacy risks and controls, conducted before development or acquisition and on material change. Source: aligns with NIST SP 800-53 Rev. 5 RA-8.

Privacy Notice

A clear, plain-language statement provided to individuals at or before PII collection that describes the authority for the collection, the purposes, the categories of PII, sharing, whether providing PII is mandatory, and how to access and correct it. Source: aligns with NIST SP 800-53 Rev. 5 PT-5.

Private Key

A cryptographic key used with an asymmetric (public key) algorithm that is uniquely associated with an owner and is not made public. Source: NIST SP 800-57 Part 1 Rev. 5 — adapted

Privileged Access Management (PAM)

The tools and processes used to secure, control, and monitor privileged accounts and sessions.

Privileged Account

A user that is authorized (and, therefore, trusted) to perform system and application functions that ordinary users are not authorized to perform. [Source: CNSSI 4009-2015]

Procedure

Specified way to carry out an activity or a process with detailed, repeatable instructions that align with policy objectives (e.g., technical solutions). It can complement a policy by detailing how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. [Source: ISO 9000:2015 Quality management systems]

Process Isolation

Maintaining a separate execution domain (for example, a separate address space) for each executing process so one process cannot modify another. Source: NIST SP 800-53 Rev. 5, SC-39.

Production Environment (Environment of Operation)

The physical, technical, and organizational setting in which an information system operates, including but not limited to: missions/business functions; mission/business processes; threat space; vulnerabilities; enterprise and information security architectures; personnel; facilities; supply chain relationships; information technologies; organizational governance and culture; acquisition and procurement processes; organizational policies and procedures; organizational assumptions, constraints, risk tolerance, and priorities/trade-offs). [Source: CNSSI 4009-2015 from NIST SP 800-30 Rev. 1]

Prohibited Company

(1) A company designated as prohibited under Iowa Code section 12K.1(4), or a company identified by DOM, DAS, or HSEMD under this policy. Source: Iowa Code § 12K.1(4). | (2) A vendor, company, or entity identified as posing an unacceptable cybersecurity or national security risk under the Enterprise Prohibited Technology and Foreign Adversary Risk Policy. Full definition established in that policy.

Prohibited Company List

The authoritative list of Prohibited Companies maintained by DOM, drawing on statutory prohibitions, federal restrictions, HSEMD designations, and joint DOM/DAS/HSEMD risk determinations.

Protected Data

Information in any form, including physical, electronic (digital), or spoken information or data that is protected by state or federal law, industry specific mandates, or that is attributed to the confidentiality, integrity, and availability of state of Iowa's resources.

Protected Health Information (PHI)

Individually identifiable health information held or transmitted by a covered entity or business associate, in any form. Source: 45 CFR §160.103.

Provenance

The documented history of the origin, custody, and changes to a system or component throughout the supply chain. Source: aligns with NIST SP 800-53 Rev. 5 SR-3 and SP 800-161.

Public-Facing

Accessible to the general public over the internet, as distinct from internal-only systems.

Public Key Infrastructure (PKI)

The architecture, organization, techniques, practices, and procedures that collectively support the implementation and operation of a certificate-based public key cryptographic system. Framework established to issue, maintain, and revoke public key certificates. [Source: CNSSI 4009-2015]

Publicly Accessible Area

An area within a facility that is open to the public and does not require physical access authorization, while still being safeguarded against movement into non-public areas. Source: aligns with NIST SP 800-53 Rev. 5 PE-3.

Publicly Accessible Content

Information that DOM intentionally makes available to the general public on systems such as public websites, portals, and social media. Source: aligns with NIST SP 800-53 Rev. 5 AC-22.

Public Record

Information created or kept by a government body that is subject to public disclosure under Iowa Code Chapter 22, unless an exception applies. Source: Iowa Code ch. 22.

Purchasing Instrument

Means an individual transactional document executed for the purchase of Deliverable(s) pursuant to an Agreement, regardless of form, and which identifies the specific Deliverable(s) to be purchased and any Acceptance Criteria or related Specifications.

R

Reconstitution

Activities performed after recovery to return a system to a fully operational and secure state, including restoring configurations, reinstalling patches, and validating security before return to operation. Source: NIST SP 800-53 Rev. 5, CP-10 discussion.

Recovery

The execution of contingency plan activities to restore organizational mission and business functions after a disruption. Source: NIST SP 800-53 Rev. 5, CP-10 discussion.

Recovery Point Objective (RPO)

The maximum acceptable amount of data loss, measured in time, that a system can tolerate after a disruption. Source: NIST SP 800-34 Rev. 1.

Recovery Time Objective (RTO)

The maximum acceptable length of time that a system or function can be down after a disruption before unacceptable harm occurs. Source: NIST SP 800-34 Rev. 1.

Registration Authority (RA)

An entity authorized by the certification authority system (CAS) to collect, verify, and submit information provided by potential Subscribers which is to be entered into public key certificates. The term RA refers to hardware, software, and individuals that collectively perform this function. Source: Aligns with NIST SP 800-32/CNSSI 4009

Remediation

The neutralization or elimination of a vulnerability or the likelihood of its exploitation. [Source: NIST SP 800-216]

Remote Access

Access to an organizational information system by a user (or an information system acting on behalf of a user) communicating through an external network (e.g., the Internet). [Source: NIST SP 800-128]

Remote Wipe

The ability to remotely erase State of Iowa information (or the secured container) from a device, typically when it is lost, stolen, or no longer authorized. Source: aligns with NIST SP 800-53 Rev. 5 MP-6.

Removable Storage Device

Portable device that can be connected to an information system (IS), computer, or network to provide data storage. These devices interface with the IS through processing chips and may load driver software, presenting a greater security risk to the IS than non-device media, such as optical discs or flash memory cards. Note: Examples include, but are not limited to: USB flash drives, external hard drives, and external solid-state disk (SSD) drives. Portable Storage Devices also include memory cards that have additional functions aside from standard data storage and encrypted data storage, such as built-in Wi-Fi connectivity and global positioning system (GPS) reception. May also be referred to as removable media. [Source: CNSSI 4009-2015]

Risk

A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. [Source: NIST SP 800-30 Rev. 1]

Risk Assessment

The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management, incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis. [Source: NIST SP 800-137 under Risk Assessment from CNSSI 4009]

Risk Response

The decision and action taken to address an identified risk — accepting, avoiding, mitigating, sharing, or transferring it — together with the rationale. Source: NIST SP 800-53 Rev. 5, RA-7; NIST SP 800-39.

Risk Tolerance

The level and type of risk an organization is willing to accept in pursuit of its mission and objectives. Source: aligns with NIST SP 800-39.

Role-Based Access Control (RBAC)

A method of granting access based on a user's assigned role rather than individual identity. Source: aligns with NIST SP 800-53 Rev. 5 AC-3 and AC-6.

Role-Based Security and Privacy Awareness Training

Role-based training strives to produce relevant and needed security and privacy knowledge and skills within the workforce. Role-Based Security and Privacy Training supports competency development and helps personnel understand and learn how to better perform their specific security or privacy role, which ultimately achieves more secure and protected information and systems.

Root Certificate Authority

In a hierarchical public key infrastructure (PKI), the certification authority (CA) whose public key serves as the most trusted datum (i.e., the beginning of trust paths) for a security domain. [Source: CNSSI 4009-2015]

Rules of Behavior

(1) A type of access agreement that describes a user's responsibilities and expected conduct for using information and systems. Source: aligns with NIST SP 800-53 Rev. 5 PL-4. Policy Analyst to confirm or assign source citation. | (2) The expected behaviors and responsibilities that individuals will follow when accessing State systems and information. Full definition to be established in the Acceptable Use and Rules of Behavior Policy. Source: aligns with NIST SP 800-53 Rev. 5 PL-4.

S

Sanitize

Actions taken to render information written on media unrecoverable by both ordinary and, for some forms of sanitization, extraordinary means. [Source: NIST SP 800-172]

Security and Privacy Architecture

A description of how security and privacy functions and controls are allocated and integrated within a system and with the enterprise architecture. Source: aligns with NIST SP 800-53 Rev. 5 PL-8.

Security and Privacy Engineering Principles

Foundational design principles applied across the system development life cycle to build trustworthy, secure, and resilient systems and to reduce privacy risk. Source: NIST SP 800-53 Rev. 5, SA-8; NIST SP 800-160.

Security Categorization

The process of determining the security category for information or an information system. Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS 199 for other than national security systems. [Source: NIST SP 800-137 under 'security categorization' from CNSSI 1253, FIPS 199]

Security Control Baseline Tailoring

The process of customizing a selected control baseline by adding, removing, or modifying controls to fit a system's mission, environment, and risk. Source: aligns with NIST SP 800-53 Rev. 5 PL-11. Policy Analyst to confirm or assign source citation.

Security Incident (HIPAA)

The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations in an information system. Source: 45 CFR §164.304.

Security Information and Event Management (SIEM)

A platform that collects, correlates, and analyzes audit and event data from across the enterprise to support monitoring, alerting, and investigation. Source: State CyberGUARD program definition.

Security Marking

The application or use of human-readable security attributes on system media to indicate distribution limitations, handling caveats, and applicable markings. Source: NIST SP 800-53 Rev. 5, MP-3.

Security Operations Center (SOC)

The State of Iowa DOM DoIT team that receives incident reports and directs and coordinates enterprise incident response on a 24/7 basis.

Senior Agency Official for Privacy (SAOP)

The senior official with enterprise authority and accountability for the privacy program. Source: aligns with NIST SP 800-53 Rev. 5 PM-19.

Sensitive Information

Information that could adversely affect the national interest, federal or state programs, organizational or enterprise interests, or individual privacy (e.g., confidential). This includes data that can be used to distinguish or trace an individual's identity or any information requiring protection based on data criticality and system value.

Separation of Duty (SOD)

Refers to the principle that no user should be given enough privileges to misuse the system on their own. For example, the person authorizing a paycheck should not also be the one who can prepare them. Separation of duties can be enforced either statically (by defining conflicting roles, i.e., roles which cannot be executed by the same user) or dynamically (by enforcing the control at access time). An example of dynamic separation of duty is the two-person rule. The first user to execute a two-person operation can be any authorized user, whereas the second user can be any authorized user different from the first [R.S. Sandhu., and P Samarati, "Access Control: Principles and Practice," IEEE Communications Magazine 32(9), September 1994, pp. 40-48.]. There are various types of SOD, an important one is history-based SOD that regulate for example, the same subject (role) cannot access the same object for variable number of times. [Source: NIST SP 800-192]

ServiceDesk Plus (SDP)

The enterprise information technology (IT) Service Management (ITSM) platform.

Service Level Agreement (SLA)

Represents a commitment between a service provider and one or more customers and addresses specific aspects of the service, such as responsibilities, details on the type of service, expected performance level (e.g., reliability, acceptable quality, and response times), and requirements for reporting, resolution, and termination. [Source: NIST SP 800-47 Rev. 1]

Session Authenticity

Assurance, at the session level, of the ongoing identity of communicating parties and the validity of transmitted information, protecting against man-in-the-middle attacks and session hijacking. Source: NIST SP 800-53 Rev. 5, SC-23.

Session Lock (Device Lock)

The temporary suspension of a user session that hides screen content and requires re-authentication to resume, without ending the session. Source: aligns with NIST SP 800-53 Rev. 5 AC-11.

Session Termination

The full ending of a user session, requiring the user to start a new session and re-authenticate. Source: aligns with NIST SP 800-53 Rev. 5 AC-12.

Significant Change (Information System or its Environment)

A change to a system or its environment of operation that is likely to affect its security or privacy state, such as new or changed threats, hosting or vendor changes, changes to system boundaries or information types, or changes to key controls. Source: aligns with NIST SP 800-37 Rev. 2, adapted.

Single-Factor Authentication

A characteristic of an authentication system or an authenticator that requires only one authentication factor (something you know, something you have, or something you are) for successful authentication. [Source: NIST SP 800-63-3]

Social Engineering

An attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks. [Source: CNSSI 4009-2015]

Software

Computer programs and data stored in hardware, typically in read-only memory (ROM) or programmable read-only memory (PROM), such that the programs and data cannot be dynamically written or modified during execution of the programs. These are the material physical components of an information system. Source: CNSSI 4009-2022

Spam Protection

Mechanisms that detect and act on unsolicited bulk messages, which may carry malicious content or be used in phishing. Source: aligns with NIST SP 800-53 Rev. 5 SI-8.

Split Tunneling

A remote-access configuration in which a device connects to an organizational network and an external network at the same time, creating a potential bypass of boundary controls. Source: NIST SP 800-53 Rev. 5, SC-7(7).

Stakeholder

Individual or organization having a right, share, claim, or interest in a system or in its possession of characteristics that meet their needs and expectations. [Source: NIST SP 800-160v1r1 from ISO/IEC/IEEE 15288:2015]

Standard User Account

An account type that is allowed within a system, typically by individuals for regular access to the system. These accounts are defined and managed according to organizational policies and security standards. [Source: Aligns with NIST SP 800-53 Rev 5, AC-2, Account Management]

State Data

All data, records, information, or content, in any form, that is provided by a state governmental entity to a vendor or that is collected, generated, or otherwise obtained by the vendor in the course of providing a good or service to the state governmental entity. 'State data" does not include aggregated or deidentified data collected by the vendor and used exclusively for the vendor's internal purposes directly related to evaluating or improving system performance, ensuring reliability, evaluating product functionality, conducting system analytics, projecting needs through capacity planning, ensuring license compliance, or evaluating security.

State Vendor Supply Chain

The set of vendors, suppliers, and their sub-suppliers that provide technology, components, systems, or services to the State. Source: aligns with NIST SP 800-161.

Subordinate Certificate Authority

In a hierarchical public key infrastructure (PKI), a certificate authority (CA) whose certificate signing key is certified by another CA, and whose activities are constrained by that other CA. See superior certification authority. [Source: CNSSI 4009-2015]

Supply Chain

The set of organizations, people, activities, and resources involved in creating and delivering a system, component, or service, from development through disposal. Source: aligns with NIST SP 800-53 Rev. 5 SR family and SP 800-161.

Supply Chain Risk Assessment

An assessment of the risks introduced by the products, services, and suppliers involved in a system's supply chain. Source: NIST SP 800-53 Rev. 5, RA-3(1).

Supply Chain Risk Management (SCRM)

The process of identifying, assessing, and reducing risks associated with the products, systems, and services obtained from external providers. Source: aligns with NIST SP 800-53 Rev. 5 SR-1 and SP 800-161.

Supported Entity

Under Iowa Code section 8.76(13), a "Supported Entity is a unit of state government, which is an authority, board, commission, committee, council, department, or independent agency as defined in Iowa Code section 7E.4, including but not limited to each principal central department enumerated in Iowa Code section 7E.5. However, "Supported Entity" does not include: a. The office of the governor or the office of an elective constitutional or statutory officer. b. The general assembly, or any office or unit under its administrative authority. c. The judicial branch, as provided in Iowa Code section 602.1102. d. A political subdivision of the state or its offices or units, including but not limited to a county, city, or community college. e. The state board of regents and institutions operating under its authority.

Synthetic Data

Artificially generated data that mimics the structure, formats, and statistical patterns of real data without containing any actual individual’s records. For Iowans, that means fabricated members, claims, and dates that load and behave like production data but trace back to no real person.

System Account

Account type within an information system that allows users to access and manage system resources. System accounts can include various types such as individual, group, temporary, system, guest, anonymous, emergency, developer, and service accounts. Organizations define and manage these accounts to ensure proper access authorizations and to mitigate security risks associated with unauthorized access. [Source: NIST SP 800-171 Rev. 3]

System Backup

A copy of system-level information, user-level information, and system documentation created and retained so that systems and data can be restored following a disruption, failure, or compromise. Source: NIST SP 800-53 Rev. 5, CP-9 discussion.

System Component

A discrete hardware, software, or firmware part of a system, including applications, operating systems, and network devices. Source: NIST SP 800-53 Rev. 5 glossary.

System Criticality Rating

A classification that ranks each production system or application by how essential it is to mission and business functions, used to set recovery priority and objectives (for example, a five-tier scheme). Source: aligns with NIST SP 800-34 Rev. 1.

System Development Life Cycle (SDLC)

The overall process of developing, implementing, operating, and retiring a system across defined phases, into which security and privacy are integrated. Source: aligns with NIST SP 800-53 Rev. 5, SA-3, and NIST SP 800-160.

System Maintenance

For the purposes of CyberGUARD information security policies and procedures, system maintenance includes all types of maintenance to any system component (including applications), conducted by any local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing or information retention such as scanners, copiers, and printers. It does not include application updates performed under release management processes.

System Media

Digital and non-digital media used to store information, including flash drives, external and removable hard drives, magnetic tapes, optical discs, paper, and microfilm, as well as mobile devices with storage capability. Source: NIST SP 800-53 Rev. 5, MP family.

System Monitoring

Observation of events at a system's external interfaces and within the system to detect attacks, unauthorized activity, and indicators of compromise. Source: aligns with NIST SP 800-53 Rev. 5 SI-4.

System of Record

An authoritative source for managing and storing change-related documentation and decisions. A group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. [Source: NIST SP 800-53 Rev. 5 from 5 U.S.C., Sec. 552a(a)(5)]

System of Records Notice (SORN)

A public notice describing a system of records from which information about individuals is retrieved by a personal identifier, including categories of records, routine uses, and procedures for access and correction. Source: aligns with NIST SP 800-53 Rev. 5 PT-6 and the federal Privacy Act of 1974. Applicability to State systems to be confirmed by Legal.

System Security and Privacy Plan

A document that describes a system's authorization boundary, operational context, security and privacy requirements, and the controls selected to meet them. Source: aligns with NIST SP 800-53 Rev. 5 PL-2.

System Use Notification

A mechanism used to inform individuals about the acceptable use and security policies associated with accessing and interacting with an information system. The purpose of a system use notification is to establish awareness among individuals regarding their responsibilities, the potential monitoring of their activities, and the consequences of unauthorized or improper use of the system. System use notifications can be implemented using messages or warning banners and are displayed before individuals log into the system. [Source: Aligns with NIST SP 800-53 Rev 5, AC-8]

T

Tampering

An unauthorized physical or logical change to a system or component. Source: aligns with NIST SP 800-53 Rev. 5 SR-9 and SR-10.

Threat

Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. Also, the potential for a threat-source to successfully exploit a particular information system vulnerability. [Source: FIPS 200 under 'threat' from CNSSI 4009- Adapted]

Threat Hunting

The proactive search through systems and networks to detect and isolate threats that evade existing controls. Source: NIST SP 800-53 Rev. 5, RA-10 (above the Moderate baseline).

Timely Maintenance

The provision of maintenance support and spare parts for defined system components within a defined time period after a failure. Source: aligns with NIST SP 800-53 Rev. 5 MA-6.

Trust Anchor

An authoritative source, such as a root certificate authority, for which trust is assumed rather than derived, used to validate a chain of trust. Source: NIST SP 800-53 Rev. 5, SC-17 discussion.

U

Undue or Unacceptable Risk

A level of risk that DAS or DOM, after qualified review, determines to be beyond the State's tolerance for a given technology, service, or supplier. Source: aligns with NIST SP 800-30.

Unified Endpoint Management (UEM)

Software that enables IT and security teams to monitor, manage, and secure all of an organization's end-user devices, such as desktops, laptops, tablets, and more, in a consistent manner with a single suite of tools, regardless of operating system or location.

Uninterruptible Power Supply (UPS)

An electrical system that provides near-instantaneous emergency power when the primary power source fails, allowing an orderly shutdown or transition to long-term alternate power. Source: aligns with NIST SP 800-53 Rev. 5 PE-11.

Unsupported Systems

Includes those for which the manufacturer or vendor no longer provides security updates, patches, or technical support.

User

Individual or (system) process authorized to access an information system. [Source: NIST SP 800-18 Rev 1 under 'user' from NSSI 4009]

V

Visitor

An individual who does not hold permanent physical access authorization credentials for a facility. Source: aligns with NIST SP 800-53 Rev. 5 PE-2 and PE-8.

Voluntary Product Accessibility Template (VPAT)

A document template established by the Information Technology Industry (ITI) Council to evaluate the accessibility of a product according to Section 508 Standards. Vendors use the VPAT® to create a self-disclosing document called an Accessibility Conformance Report (ACR), which details how the product meets each Section 508 requirement and identifies any potential deficiencies. The Voluntary Product Accessibility Template (VPAT®) serves as a standardized reporting format that helps buyers and sellers assess the accessibility features of information and communications technology (ICT) products and services.

Vulnerability

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. [Source: FIPS 200 under 'vulnerability' from CNSSI 4009- Adapted]

W

Web Application

An interactive application delivered through a web browser that collects, processes, or transacts information for public users, providing functionality beyond content publishing. Web applications are not required to run on the Content Management System.

Web Content Accessibility Guidelines (WCAG)

Technical standards developed by the W3C's Web Accessibility Initiative (WAI). They provide a framework to help developers and designers make web content accessible to people with a wide range of disabilities. WCAG is widely cited by accessibility laws and regulations around the world. By April 2027, Iowa state agency websites much comply with WCAG version 2.1 Level AA criteria.

Website

A public-facing site whose primary purpose is publishing and managing web content for the public. Websites are built and maintained on the official Content Management System (CMS).

Wireless Access

Access to, or exchange of data with, an information system over radio frequency or other non-physical medium, including but not limited to Wi-Fi, Bluetooth, cellular, and near-field communication, rather than a physical wired connection. Source: aligns with NIST SP 800-53 Rev. 5 AC-18.

Workforce Member

Employees, volunteers, trainees, and other persons whose conduct is under the direct control of an entity, whether or not paid. Source: 45 CFR §160.103.

Z

Zero-Day Attack

An attack that exploits a previously unknown hardware, firmware, or software vulnerability. [Source: CNSSI 4009-2015]

#

(Digital) Certificate Transparency

A public logging system that records certificates issued by Certificate Authorities (CAs) so that unauthorized or mistaken issuance can be detected. Source: RFC 6962 — adapted