Glossary

Security & Compliance

The cybersecurity and compliance frameworks and clearances a contractor has to meet or reference in a proposal, including CMMC, FedRAMP, FISMA, and NIST, plus the authorization and access-management terms (ATO, RMF, POA&M) that go with them. Written for IT security leads and proposal writers responding to security requirements in a solicitation.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
All
Acquisition Planning
AI Fundamentals & AI for Proposals
Capture & Business Development
Contract Administration
Contract Types & Pricing
Contract Vehicles
Federal Agencies
Federal Procurement & Regulations
Personnel & Roles
Professional Associations
Proposal Management
Security & Compliance
Shipley Proposal Process
Small Business Programs
Solicitations
Authority to Operate
Formal authorization for an information system to operate based on security assessment.
Security & Compliance
Communications Security
Measures, equipment, and procedures used to protect government voice, data, and message traffic from interception or unauthorized disclosure.
Security & Compliance
Controlled Unclassified Information
Government information requiring safeguarding below the classified threshold.
Security & Compliance
Cybersecurity Maturity Model Certification
DoD framework certifying contractor cybersecurity practices.
Security & Compliance
Federal Information Security Management Act
A federal law requiring agencies to develop and operate risk-based information security programs for their systems, including systems run by contractors on the agency's behalf.
Security & Compliance
Federal Risk and Authorization Management Program
A government-wide program that standardizes the security assessment and continuous monitoring of cloud services sold to federal agencies, so a provider can be assessed once and reused across agencies.
Security & Compliance
GCC High
A segregated Microsoft 365 cloud environment, administered only by screened U.S. persons, built to satisfy DFARS, ITAR/EAR, and CMMC Level 2/3 requirements.
Security & Compliance
GovCloud
Isolated cloud regions built to meet elevated federal security requirements, restricting access to vetted U.S. persons and hosting data within the U.S.
Security & Compliance
Identity and Access Management
The framework of policies and technology governing who can access which systems and data, and what they are permitted to do once inside.
Security & Compliance
Identity, Credential, and Access Management
The combined federal policies, processes, and technologies used to verify identity, issue credentials, and control access to systems, data, and facilities.
Security & Compliance
Information Security
The practice of protecting information and information systems from unauthorized access, disclosure, alteration, or destruction.
Security & Compliance
International Traffic in Arms Regulations
State Department regulations controlling the export and handling of defense articles, technical data, and defense services on the U.S. Munitions List.
Security & Compliance
National Institute of Standards and Technology
A Department of Commerce agency that develops measurement standards and cybersecurity frameworks, including the SP 800-171 controls that underpin many federal compliance requirements.
Security & Compliance
Operations Security
A risk-management process for identifying and protecting unclassified information that, if pieced together, could reveal sensitive plans, capabilities, or activities.
Security & Compliance
Plan of Action and Milestones
A management tool documenting identified security weaknesses in an information system, along with the remediation tasks and milestone dates needed to close them.
Security & Compliance
Public Key Infrastructure
The system of digital certificates, certificate authorities, and cryptographic keys used to verify identity and encrypt communications on federal networks.
Security & Compliance
Risk Management Framework
NIST's structured lifecycle process for managing cybersecurity risk in federal information systems, underlying the path to an Authority to Operate.
Security & Compliance
Security Technical Implementation Guide
A DISA-published configuration standard specifying how to secure a piece of hardware, software, or network device to meet DoD security requirements.
Security & Compliance