All glossary terms
Security & Compliance

National Institute of Standards and Technology

A Department of Commerce agency that develops measurement standards and cybersecurity frameworks, including the SP 800-171 controls that underpin many federal compliance requirements.

Related terms

Authority to Operate
Formal authorization for an information system to operate based on security assessment.
Communications Security
Measures, equipment, and procedures used to protect government voice, data, and message traffic from interception or unauthorized disclosure.
Controlled Unclassified Information
Government information requiring safeguarding below the classified threshold.
Cybersecurity Maturity Model Certification
DoD framework certifying contractor cybersecurity practices.
Federal Information Security Management Act
A federal law requiring agencies to develop and operate risk-based information security programs for their systems, including systems run by contractors on the agency's behalf.
Federal Risk and Authorization Management Program
A government-wide program that standardizes the security assessment and continuous monitoring of cloud services sold to federal agencies, so a provider can be assessed once and reused across agencies.
GCC High
A segregated Microsoft 365 cloud environment, administered only by screened U.S. persons, built to satisfy DFARS, ITAR/EAR, and CMMC Level 2/3 requirements.
GovCloud
Isolated cloud regions built to meet elevated federal security requirements, restricting access to vetted U.S. persons and hosting data within the U.S.
Identity and Access Management
The framework of policies and technology governing who can access which systems and data, and what they are permitted to do once inside.
Identity, Credential, and Access Management
The combined federal policies, processes, and technologies used to verify identity, issue credentials, and control access to systems, data, and facilities.
Information Security
The practice of protecting information and information systems from unauthorized access, disclosure, alteration, or destruction.
International Traffic in Arms Regulations
State Department regulations controlling the export and handling of defense articles, technical data, and defense services on the U.S. Munitions List.