Security Technical Implementation Guide

Formal authorization for an information system to operate based on security assessment.

Measures, equipment, and procedures used to protect government voice, data, and message traffic from interception or unauthorized disclosure.

Government information requiring safeguarding below the classified threshold.

DoD framework certifying contractor cybersecurity practices.

A federal law requiring agencies to develop and operate risk-based information security programs for their systems, including systems run by contractors on the agency's behalf.

A government-wide program that standardizes the security assessment and continuous monitoring of cloud services sold to federal agencies, so a provider can be assessed once and reused across agencies.

A segregated Microsoft 365 cloud environment, administered only by screened U.S. persons, built to satisfy DFARS, ITAR/EAR, and CMMC Level 2/3 requirements.

Isolated cloud regions built to meet elevated federal security requirements, restricting access to vetted U.S. persons and hosting data within the U.S.

The framework of policies and technology governing who can access which systems and data, and what they are permitted to do once inside.

The combined federal policies, processes, and technologies used to verify identity, issue credentials, and control access to systems, data, and facilities.

The practice of protecting information and information systems from unauthorized access, disclosure, alteration, or destruction.

State Department regulations controlling the export and handling of defense articles, technical data, and defense services on the U.S. Munitions List.