All glossary terms
Security & Compliance

Federal Information Security Management Act

A federal law requiring agencies to develop and operate risk-based information security programs for their systems, including systems run by contractors on the agency's behalf.

Related terms

National Institute of Standards and Technology
A Department of Commerce agency that develops measurement standards and cybersecurity frameworks, including the SP 800-171 controls that underpin many federal compliance requirements.
Operations Security
A risk-management process for identifying and protecting unclassified information that, if pieced together, could reveal sensitive plans, capabilities, or activities.
Plan of Action and Milestones
A management tool documenting identified security weaknesses in an information system, along with the remediation tasks and milestone dates needed to close them.
Public Key Infrastructure
The system of digital certificates, certificate authorities, and cryptographic keys used to verify identity and encrypt communications on federal networks.
Risk Management Framework
NIST's structured lifecycle process for managing cybersecurity risk in federal information systems, underlying the path to an Authority to Operate.
Security Technical Implementation Guide
A DISA-published configuration standard specifying how to secure a piece of hardware, software, or network device to meet DoD security requirements.