1. Important Terminology

Information System#

• The term Information System is defined according to 44 U.S.C., Sec. 3502 as “a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.”

System#

• The term system is used instead of the term information system to reflect the broader applicability of information resources of any size or complexity, organized expressly for the collection, processing, use, sharing, dissemination, maintenance, or disposition of data or information.

Information#

Information includes facts or ideas represented as data, and knowledge or instructions that can be communicated between system entities.

Information Security#

The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to ensure confidentiality, integrity, and availability.

Confidentiality#

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

Integrity#

Guarding against improper information modification or destruction and ensuring information non-repudiation and authenticity.

• Data Integrity – The property that data has not been altered in an unauthorized manner. Data integrity covers data in storage, during processing, and while in transit.
• System Integrity – The quality that a system has when it performs its intended function in an unimpaired manner, free from unauthorized manipulation of the system, whether intentional or accidental.

Availability#

Ensuring timely and reliable access to and use of information.

Security Controls#

The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for a system to protect the confidentiality, availability, and integrity of the system and its information.