Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Authorization Professional > Prepare > Flashcards

Prepare Flashcards

1
Q

Security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information.

A

Adequate Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The process an organization employs to assign security or privacy requirements to an information system or its environment of operation; or to assign controls to specific system elements responsible for providing a security or privacy capability (e.g., router, server, remote sensor).

A

Allocation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A software program hosted by an information system.

A

Application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The individual, group, or organization responsible for conducting a security or privacy assessment.

A

Assessor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

System and subsystem components that must be protected, including but not limited to: all hardware, software, data, personnel, supporting physical environment and environmental systems, administrative support and supplies.

A

Asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

All components of an information system to be authorized for operation by an authorizing official.

This excludes separately authorized systems to which the information system is connected.

A

Authorization Boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A senior federal official or executive with the authority to authorize (i.e., assume responsibility for) the operation of an information system or the use of a designated set of common controls at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the nation.

A

Authorizing Official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An organizational official acting on behalf of an authorizing official in carrying out and coordinating the required activities associated with the authorization process.

A

Authorizing Official Designated Representative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Ensuring timely and reliable access to and use of information.

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A combination of mutually reinforcing controls implemented by technical means, physical means, and procedural means. Such controls are typically selected to achieve a common information security or privacy purpose.

A

Capability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The senior official that provides advice and other assistance to the head of the agency and other senior management personnel of the agency to ensure that IT is acquired and information resources are managed for the agency in a manner that achieves the agency’s strategic goals and information resources management goals; and is responsible for ensuring agency compliance with, and prompt, efficient, and effective implementation of, the information policies and information resources management responsibilities, including the reduction of information collection burdens on the public.

A

Chief Information Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Another name for “Chief Information Security Officer.”

A

Senior Agency Information Security Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A security or privacy control that is inherited by multiple information systems or programs.

A

Common Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An organizational official responsible for the development, implementation, assessment, and monitoring of common controls.

A

Common Control Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Maintaining ongoing awareness to support organizational risk decisions.

A

Continuous Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A program established to collect information in accordance with pre-established metrics, utilizing information readily available in part through implemented security controls.

A

Continuous Monitoring Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The individual, group, or organization responsible for conducting a control assessment.

A

Assessor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An organization with a defined mission/goal and a defined boundary, using systems to execute that mission, and with responsibility for managing its own risks and performance.

A

Enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A strategic information asset base, which defines the mission; the information necessary to perform the mission; the technologies necessary to perform the mission; and the transitional processes for implementing new technologies in response to changing mission needs; and includes a baseline architecture; a target architecture; and a sequencing plan.

A

Enterprise Architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The physical surroundings in which an information system processes, stores, and transmits information.

A

Environment of Operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A business-based framework for government-wide improvement developed by the Office of Management and Budget that is intended to facilitate efforts to transform the federal government to one that is citizen-centered, results-oriented, and market-based.

A

Federal Enterprise Architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

An information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.

A

Federal Information System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

With respect to security, the effect on organizational operations, organizational assets, individuals, other organizations, or the nation (including the national security interests of the United States) of a loss of confidentiality, integrity, or availability of information or a system.

A

Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Another name for “Impact Level.”

A

Impact Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The assessed worst-case potential impact that could result from a compromise of the confidentiality, integrity, or availability of information expressed as a value of low, moderate or high.

A

Impact Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, electronic, or audiovisual forms.

A

Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The stages through which information passes, typically characterized as creation or collection, processing, dissemination, use, storage, and disposition, to include destruction and deletion.

A

Information Life Cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal.

A

Information Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The protection of information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity and availability.

A

Information Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

An embedded, integral part of the enterprise architecture that describes the structure and behavior of the enterprise security processes, security systems, personnel and organizational subunits, showing their alignment with the enterprise’s mission and strategic plans.

A

Information Security Architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

The risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the nation due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of information and/or systems.

A

Information Security Risk

33
Q

An agency official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination and disposal.

A

Information Steward

34
Q

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of information.

A

Information System

35
Q

Any services, equipment, or interconnected system(s) or subsystem(s) of equipment, that are used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency.

A

Information Technology

36
Q

For purposes of this definition, such services or equipment if used by the agency directly or is used by a contractor under a contract with the agency that requires its use; or to a significant extent, its use in the performance of a service or the furnishing of a product.

A

Information Technology

37
Q

Ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

A

Adequate Security

38
Q

With respect to privacy, the adverse effects that individuals could experience when an information system processes their PII.

A

Impact

39
Q

A specific category of information (e.g., privacy, medical, proprietary, financial, investigative, contractor-sensitive, security management) defined by an organization or in some instances, by a specific law, executive order, directive, policy, or regulation.

A

Information Type

40
Q

Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.

A

Integrity

41
Q

An entity of any size, complexity, or positioning within an organizational structure (e.g., federal agencies, private enterprises, academic institutions, state, local, or tribal governments or, as appropriate, any of their operational elements).

A

Organization

42
Q

Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.

A

Personally Identifiable Information (PII)

43
Q

Individual, group, or organization responsible for ensuring that the system privacy requirements necessary to protect individuals’ privacy are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and information systems processing PII.

A

Privacy Architect

44
Q

An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise’s privacy protection processes, technical measures, personnel and organizational sub-units, showing their alignment with the enterprise’s mission and strategic plans.

A

Privacy Architecture

45
Q

An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise’s privacy protection processes, technical measures, personnel and organizational sub-units, showing their alignment with the enterprise’s mission and strategic plans.

A

Privacy Control

46
Q

Information that describes the privacy posture of an information system or organization.

A

Privacy Information

47
Q

A formal document that details the privacy controls selected for an information system or environment of operation that are in place or planned for meeting applicable privacy requirements and managing privacy risks, details how the controls have been implemented, and describes the methodologies and metrics that will be used to assess the controls.

A

Privacy Plan

48
Q

A requirement that applies to an information system or an organization that is derived from applicable laws, executive orders, directives, policies, standards, regulations, procedures, and/or mission/business needs with respect to privacy.

A

Privacy Requirement

49
Q

Risk to an individual or individuals associated with the agency’s creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of their PII.

A

Privacy Risk

50
Q

Portion of risk remaining after security measures have been applied.

A

Residual Risk

51
Q

A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically is a function of:

(i) the adverse impact, or magnitude of harm, that would arise if the circumstance or event occurs.

(ii) the likelihood of occurrence.

A

Risk

52
Q

The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the nation, resulting from the operation of a system.

A

Risk Assessment

53
Q

An individual or group within an organization, led by the senior accountable official for risk management, that helps to ensure that security risk considerations for individual systems, to include the authorization decisions for those systems, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization in carrying out its missions and business functions; and managing risk from individual systems is consistent across the organization, reflects organizational risk tolerance, and is considered along with other organizational risks affecting mission/business success.

A

Risk Executive (Function)

54
Q

The program and supporting processes to manage risk to agency operations (including mission, functions, image, reputation), agency assets, individuals, other organizations, and the nation, and includes: establishing the context for risk-related activities; assessing risk; responding to risk once determined; and monitoring risk over time.

A

Risk Management

55
Q

Prioritizing, evaluating, and implementing the appropriate risk-reducing controls/countermeasures recommended from the risk management process.

A

Risk Mitigation

56
Q

Accepting, avoiding, mitigating, sharing, or transferring risk to agency operations, agency assets, individuals, other organizations, or the nation.

A

Risk Response

57
Q

Individual, group or organization responsible for ensuring that the information security requirements necessary to protect the organization’s core missions and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting information systems supporting those missions and business processes.

A

Security Architect

58
Q

An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise’s security processes, information security systems, personnel and organizational sub-units, showing their alignment with the enterprise’s mission and strategic plans.

A

Security Architecture

59
Q

The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

A

Security Controls

60
Q

(i.) Confidentiality
(ii.) Integrity
(iii.) Availability

A

Security Objective

61
Q

A requirement levied on an information system or an organization that is derived from applicable laws, executive orders, directives, policies, standards, instructions, regulations, procedures, and/or mission/business needs to ensure the confidentiality, integrity, and availability of information that is being processed, stored, or transmitted.

A

Security Requirement

62
Q

Risk that arises through the loss of confidentiality, integrity, or availability of information or systems and that considers impacts to the organization (including assets, mission, functions, image, or reputation), individuals, other organizations, and the nation.

A

Security Risk

63
Q

The senior official, designated by the head of each agency, who has vision into all areas of the organization and is responsible for alignment of information security management processes with strategic, operational, and budgetary planning processes.

A

Senior Accountable Official for Risk Management

64
Q

Official responsible for carrying out the Chief Information Officer responsibilities under FISMA and serving as the Chief Information Officer’s primary liaison to the agency’s authorizing officials, information system owners, and information system security officers.

A

Senior Agency Information Security Officer

65
Q

The senior official, designated by the head of each agency, who has agency-wide responsibility for privacy, including implementation of privacy protections; compliance with federal laws, regulations and policies relating to privacy; management of privacy risks at the agency; and a central policymaking role in the agency’s development and evaluation of legislative, regulatory, and other policy proposals.

A

Senior Agency Official for Privacy

66
Q

Any organized assembly of resources and procedures united and regulated by interaction or interdependence to accomplish a set of specific functions.

A

System

67
Q

Another name for “Authorization Boundary.”

A

System Boundary

68
Q

A discrete identifiable information technology asset that represents a building block of a system and may include hardware, software, and firmware.

A

System Component

69
Q

The scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation.

A

System Development Life Cycle (SDLC)

70
Q

Member of a set of elements that constitute a system.

A

System Element

71
Q

Individual assigned responsibility for conducting systems privacy engineering activities.

A

Systems Privacy Engineer

72
Q

Individual with assigned responsibility for maintaining the appropriate operational privacy posture for a system or program.

A

Systems Privacy Officer

73
Q

Individual assigned responsibility for conducting systems security engineering activities.

A

Systems Security Engineer

74
Q

Individual with assigned responsibility for maintaining the appropriate operational security posture for an information system or program.

A

Systems Security Officer

75
Q

Individual, or (system) process acting on behalf of an individual, authorized to access a system.

A

System User

76
Q

Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

A

Threat

77
Q

The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability.

A

Threat Source

78
Q

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

A

Vulnerability

Certified Authorization Professional (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions