Attachment 2 PWS Attachment A.docx

ATTACHMENT A: TERMS AND DEFINITIONS

For purposes of this PWS, the terms in this section have the meanings set forth below, as defined by or adapted from the authoritative source material. Any terms used, but not defined in this PWS, shall have the meaning set forth in the contract.

· Access – “Ability to make use of any information system (IS) resource.” (NIST 800-32). The IS resources in this PWS encompasses the Government’s applications, databases, and network systems.

· Access Control – “The process of granting or denying specific requests: 1) for obtaining and using information and related information processing services; and 2) to enter specific physical facilities (e.g., federal buildings, military establishments, and border crossing entrances).” (CNSSI 4009) The first meaning applies to software requirements in this PWS.

· Access Control System – A set of procedures and/or processes, normally automated, which allows access to a controlled area or to information to be controlled, in accordance with pre-established policies and rules. (NIST SP 800-152).

This includes both the Automated Access Control System (AACS) and Automated Entry Control System (AECS) used and managed at the PHNSY&IMF.

· Accreditation – “Formal declaration by a designated accrediting authority or principal accrediting authority that an information system is approved to operate at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural safeguards.” (CNSSI 4009) The designated accrediting authority for PHNSY&IMF information systems is the DoN U.S. Fleet Cyber Command’s Navy Authorizing Official, which provides the approval to operate.

· Active Directory (AD) – Microsoft Windows domain used to authenticate and authorize users. Group policy objects are used within AD.

· Activity Command Information Officer (ACIO) – The ACIO for the PHNSY&IMF Command is also the Code 109 Department Head.

· AD HOC – “A wireless network that allows easy connection establishment between wireless client devices in the same physical area without the use of an infrastructure device, such as an access point or a base station.” (NIST SP 800-121)

· Administrator – In this PWS context, refers to “A highly privileged role a person may have for performing security-related administrative tasks (e.g., customize the audit features for the system). (Adapted from NIST SP 800-13).

· After Hours – Refers to hours that fall outside the main work hours of the first shift of work, Monday through Friday, between 6:30 and 15:00 hours.

· Alert – “Notification that a specific attack has been directed at an organization’s information systems.” (CNSSI 4009)

· Allocation – When used as a noun, “The process an organization employs to assign security or privacy requirements to an information system or its environment of operation; or to assign controls to specific system elements responsible for providing a security or privacy capability (e.g., router, server, remote sensor).” (CNSSI 4009, NIST SP 800-37 Rev 2) Allocating when used as a verb shall mean employing the allocation process.

· Application – “A software program hosted by an information system.” (NIST SP 800-37 Rev 2)

· Approval to Operate (ATO) – See “Accreditation.”

· Architecture – In this PWS, this term most often applies to database architecture, which uses programming languages to design, development, and maintenance of computer programs that store and organize information for businesses, agencies, and institutions.

· Area of Responsibility (AOR) – Refers to either the geographical boundaries of authority held by PHNSY&IMF or a Code 109 branch functional area.

· Assessment – See “Risk Assessment.”

· Assessment and Authorization (A&A) – Term used in the Risk Management Framework (RMF) process for assessing and authorizing PHNSY&IMF information systems for approval by the NAO. Also refers to a functional area in the Code 109.23 branch.

· Assessment Method – “One of three types of actions (i.e., examine, interview, test) taken by assessors in obtaining evidence during an assessment.” (NIST SP 800-53A Rev 4)

· Asset – “A major application, general support system, high impact program, physical plant, mission critical system, personnel, equipment, or a logically related group of systems.” (CNSSI 4009) In this PWS, an asset represents IT property owned by PHNSY&IMF for purposes of inventory recording, including security scanning and reporting responsibilities.

· Asset Reporting – “Information about assets and the relationships between assets and reports.” (Adapted from NIST 800-126 Rev 3)

· Assurance – “The grounds for confidence that the set of intended security controls in an information system are effective in their application.” (CNSSI 4009) Applies to software requirements for testing security functionality and resiliency attack in this PWS.

· Assured Compliance Assessment Solution (ACAS) – Information security tools used for vulnerability scanning and risk assessment within DoD.

· Attack – “Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.” (CNSSI 4009)

· Audit – When used as a noun, refers to an “Independent review and examination of records and activities to assess the adequacy of system controls and ensure compliance with established policies and operational procedures.” (CNSSI 4009) The independent review and examination covers both internal and external audits performed on a determined basis. The Auditor performing the audit, can include any party internal or external to PHNSY&IMF.

Audit/Auditable, when used as an adjective in this PWS, applies to a collection of data used for purposes of an audit.

· Audit Log – “A chronological record of system activities. Includes records of system accesses and operations performed in a given period.” (CNSSI 4009)

· Authentication – “1. Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.” (FIPS PUB 200) “2. A security measure designed to protect a communications system against acceptance of fraudulent transmission or simulation by establishing the validity of a transmission, message, originator, or a means of verifying an individual’s eligibility to receive specific categories of information.” (CNSSI 4009 & 4005; NSA/CSS Manual Number 3-16)

· Authorization to Operate (ATO) – “The official management decision issued by a designated accrediting authority or principal accrediting authority to authorize operation of an information system and to explicitly accept the residual risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals.” (NIST SP 800-53 Rev 4) The designated accrediting authority for PHNSY&IMF information systems is the DoN U.S. Fleet Cyber Command’s Navy Authorizing Official.

· Authorized Service Interruption (ASI) – A management approved interruption in service to any network, system, application due to required maintenance, updates, or troubleshooting. All other service interruptions without the proper management/board approval is deemed an unauthorized service interruption (USI).

· Authorizing Official (AO) – Role in the DoN RMF process. “A senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.” (CNSSI 4009)

· Availability – “1. Ensuring timely and reliable access to and use of information.” (44 USC §3542) “2. Timely, reliable access to data and information services for authorized users.” (NSA/CSS Manual Number 3-16)

· Baseline – “Hardware, software, and relevant documentation for an information system at a given point in time.” (CNSSI 4009) Sometimes used as an adjective in this PWS for the type of data or requirements a baseline needs to be established for.

· Baseline Configuration – “A documented set of specifications for an information system, or a configuration item within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures.” (NIST SP 800-53 Rev 4)

· Batch Processing – Jobs that can run without end user interaction. In this PWS, implemented as “Batch Operations” and “Batch Runs.”

· Business Hours – Weekdays, Monday through Friday, 6:30 to 15:00 not including federal holidays and when PHNSY&IMF is closed for administrative reasons.

· Business Objects – Provides performance management, planning, reporting, query and analysis and enterprise information management.

· Cable Plant – Network cable infrastructure to include Outside Plant (OSP) and Inside Plant (ISP).

· Certification and Accreditation (C&A) – Previous term used for the A&A process to authorize information systems. “Certification involves the testing and evaluation of the technical and nontechnical security features of an IT system to determine its compliance with a set of specified security requirements. Accreditation is a process whereby a Designated Approval Authority (DAA) or other authorizing management official authorizes an IT system to operate for a specific purpose using a defined set of safeguards at an acceptable level of risk.” (NIST SP 800-47)

· Change Advisory Board (CAB)

· Clearance – “A formal security determination by an authorized adjudicative office that an individual is authorized access, on a need to know basis, to a specific level of classified information (TOP SECRET, SECRET, or CONFIDENTIAL).” (CNSSI 4009)

· Commander, Submarine Force, U.S. Pacific Fleet (CSP) – “Principal advisor to the Commander, U.S. Pacific Fleet for submarine matters.” (csp.navy.mil)

· Commander, Submarine Squadron Fifteen (COMSUBRON15) – Squadron of submarines stationed at Naval Base Guam.

· Computer Aided Design (CAD) – Software used in drafting technical drawings and documentation.

· Common Access Card (CAC) – “Standard identification/smart card issued by the DoD that has an embedded integrated chip storing public key infrastructure certificates.” Note: As per DoDI 1000,13, “the CAC, a form of DoD ID card, shall serve as the Federal personal identity verification card for DoD implementation of Homeland Security Presidential Directive 12.” (CNSSI 4009, DoDI 1000.13)

· Communications Security (COMSec) – “A component of Information Assurance that deals with measures and controls taken to deny unauthorized persons information derived from telecommunications and to ensure the authenticity of such telecommunications. COMSec includes cryptographic security, transmission security, emissions security, and physical security of COMSec material.” (CNSSI 4009, 4005)

· Computer Based Training (CBT) – Training that is delivered and accessed through a computer. At PHNSY&IMF, CBT is generally provided through the DoN’s Total Workforce Management Services site and the Navy e-Learning site. There are government-mandated annual CBT requirements for civilian, contractor, and military personnel.

· Concept of Operations (CONOPS) – “A security-focused description of an information system, its operational policies, classes of users, interactions between the system and its users, and the system’s contribution to the operational mission.” (CNSSI 4009)

· Confidentiality –“Assurance that sensitive information is preserved and not disclosed to unauthorized system entities (users, processes, or devices). This includes the protection of operational information, cybersecurity-related system information, and CUI, to include personally identifiable information and proprietary information.” (OPNAVINST 5239.1D) “Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.” (44 USC §3542)

· Configuration Management (CM) – “A collection of activities focused on establishing and maintaining the integrity of information technology products and information systems, through control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the system development life cycle.” (NIST SP 800-53 Rev 4) All CM items must be first approved by the Code 109 Configuration Management Board before they are implemented.

· Corporate Shipyard Application Suite (CSAS) - “The collection of PMO-IT managed software applications created to support Shipyard operations. These applications include: AIM, AIMxp, AIM4GUAM, ARCMIS, ATIS, ATMS, Business Objects, COST, DTR, EFEM, MAT, MRQT, NWPS (PMC, QPS,SPF), Payroll, PSS, QDB, SABRS and SUPDESK.”

· Countermeasures – “Actions, devices, procedures, techniques, or other measurers that reduce the vulnerability of an information system. Synonymous with security controls and safeguards.” (NIST 800 SP 800-37 Rev 1, FIPS PUB 200) Most often applied in this PWS to software requirements to prevent potential exploitations in programming language.

· Coverage – There are two meanings for this term in this PWS. The first application, which occurs most often, relates to the amount of work required for the number of shifts or business hours at the PHNSY&IMF.

The second application relates to a cybersecurity assessment method and is defined as “An attribute associated with an assessment method that addresses the scope or breadth of the assessment objects included in the assessment (e.g., types of objects to be assessed and the number of objects to be assessed by type). The values for the coverage attribute, hierarchically from less coverage to more coverage, are basic, focused, and comprehensive.” (NIST SP 800-53 Rev 1, NIST SP 800-137)

· CSFC - Commercial Solutions for Classified (CSfC) is NSA’s strategy for leveraging industry innovation to delivery cybersecurity solutions efficiently and securely.

· Credentialed Scan – In cybersecurity, a computer with an account that has trusted access to the systems to complete an authenticated scan for vulnerabilities, which is more detailed than a non-credentialed scan.

· Cross Domain – “An act of manually and/or automatically accessing and/or transferring information between different security domains.” (CNSSI 4009) In the PWS, used to as an adjective to describe user services to transfer data between PHNSY&IMF systems and media.

· Customer – Refers to many groups of PHNSY&IMF users (military, contractors, civilians), internal or external to PHNSY&IMF, that require IT and cybersecurity services to support their mission capabilities.

· Cyber Incident (CI) – “Actions taken through the use of an information system or network that result in an actual or potentially adverse effect on an information system, network, and/or the information residing therein.” (CNSSI 4009) Code 109 works in conjunction with Code 1120 (Security) to process cyber incidents that occur at PHNSY&IMF.

· Cybersecurity – “Prevention of damage to, protection of, and restoration of computers, electronic communication systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.” (CNSSI 4009, NSPD-54/HSPD-23).

“…Note: DoDI8500.01 has transitioned from the term information assurance (IA) to the term cybersecurity.” (CNSSI 4009) Both information assurance and cybersecurity terms are used interchangeably in this PWS.

· Cybersecurity Workforce (CSWF) – “Personnel who secure, defend, and preserve data, networks, net-centric capabilities, and other designated systems by ensuring appropriate security controls and measures are in place, and taking internal defense actions. This includes access to system controls, monitoring, administration, and integration of cybersecurity into all aspects of engineering and acquisition of cyberspace capabilities.” (DoDD 8140.01)

· Cyberspace – “The interdependent network of information technology infrastructures, and includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries.” (NSPD-54/HSPD-23)

· Daily Business Hours – Normally, unless specified in the PWS, the time between 0630 and 1500, Monday through Fridays.

· Daily Check – Established checks to be completed daily as part of a Standard Operating Procedure (SOP).

· Dashboard – In this PWS, the term applies to a security management dashboard, which is “A tool that consolidates and communicates information relevant to the organizational security posture in near real-time to security management stakeholders.” (NIST SP 800-137, NIST SP 800-128)

· Data Integrity – “The property that data has not been altered in an unauthorized manner. Data integrity covers data in storage, during processing, and while in transit.” (CNSSI 4009, NIST SP 800-33)

· Data Mining – “An analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery.” (NIST SP 800-53 Rev 4) Primarily used in database management operations for application databases in this PWS.

· Data Spill – Otherwise relates to “spillage,” which describes a “Security incident that results in the transfer of classified information onto an information system not authorized to store or process that information.” (CNSSI 4009)

· Data Warehousing – Used as an adjective in the PWS to describe data management programs that assist with business management decisions by being able to easily extract, transform, and load business data stored in a repository for analysis.

· Database Administration – See Administrator.

· Database Management System Software – Software designed to store, retrieve, and manage data in a database.

· Defense Information System Agency (DISA) – DoD combat support agency that “provides, operates, and assures command and control and information sharing capabilities and a globally accessible enterprise information infrastructure in direct support to joint warfighters, national level leaders, and other mission and coalition partners across the full spectrum of military operations.” (https://disa.mil/About/Our-Work) Provides standards and guidelines for DoD information networks at PHNSY&IMF.

· Defense Logistics Agency (DLA) – DoD combat logistics support agency that “manages the global supply chain – from raw materials to end user disposition – for the Army, Marine Corps, Navy, Air Force, Space Force, Coast Guard, 11 combatant commands, other federal agencies, and partner and allied nations.” (https://dla.mil/AboutDLA/) DLA processes documentation of equipment sent to DRMO by Code 109.

· Defense Priorities and Allocations System (DPAS) – DoD system to “assure the timely availability of industrial resources to meet current national defense and emergency preparedness program requirements and to provide an operating system to support rapid industrial response in a national emergency.” (https://www.dcma.mil/DPAS/) Code 109 uses this system to manage assets and materials at the PHNSY&IMF and Guam Naval Base.

· Defense Reutilization Market Office (DRMO) – A part of the DLA, “the DLA Disposition Services disposes of excess property received from the military services…The property is first offered for reutilization within the DoD, transfer to other federal agencies or donation to state and local governments and other qualified organizations.” (https://dla.mil/DispositionServices/About/Mission)

· Defensive Cyberspace Operations (DCO) – “Missions to preserve the ability to utilize blue cyberspace capabilities and protect data, networks, cyberspace-enabled devices, and other designated systems by defeating on-going or imminent malicious cyberspace activity.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended)

· Denial of Authorization to Operate (DATO) – Similar to the ATO definition in that “The official management decision issued by a designated accrediting authority or principal accrediting authority…” but the accrediting authority does not authorize operation of an information system. This decision is made after an authorization package is submitted for review.

· Department of Energy (DoE) – Federal executive agency established in 1977 tracing its lineage “to the Manhattan Project…and to the various energy-related programs that previously had been dispersed throughout various Federal agencies.” (https://energy.gov/about-us) Sets nuclear requirements and guidelines for the DoN’s nuclear program.

· Department of Navy (DoN) – “The executive part of the Department of the Navy at the seat of government; the headquarters, United States Marine Corps; the entire operating forces of the United States Navy and of the United States Marine Corps, including the Reserve Component of such forces; all field activities, headquarters, forces, bases, installations, activities, and functions under the control or supervision of the Secretary of the Navy; and the United States Coast Guard when operating as a part of the Navy pursuant to law.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended)

· Depth – “An attribute associated with an assessment method that addresses the rigor and level of detail associated with the application of the method. The values for the depth attribute, hierarchically from less depth to more depth, are basic, focused, and comprehensive.” (NIST SP 800-137)

· Derivative Classifier – An individual authorized to completed derivative classification of information, “on the basis of source documents or classification guides…” (32 CFR §2001.22)

· Desk Guide – A guide for a specific function that consolidates documentation (i.e. SOPs, checklists, flow charts, diagrams, ports & protocols, etc.) required to perform the function.

· Digital Signage –A networked digital display content delivery system.

· Disruption – “An unplanned event that causes the general system or major application to be inoperable for an unacceptable length of time (e.g., minor or extended power outage, extended unavailable network, or equipment or facility damage or destruction).” (NIST SP 800-34 Rev 1)

· DoD Global Information Grid Operations (DGO) – Refers to the all-encompassing Global Information Grid (GIG) project of the DoD. GIG includes owned and leased communications and computing systems and services, software, data, security services, other associated services, and National Security Systems.

· Domain – “An environment or context that includes a set of system resources and a set of system entities that have the right to access the resources as defined by a common security policy, security model, or security architecture.” (NIST SP 800-53 Rev 4)

· Deficiency Tracking & Reporting (DTR) – Corporate ColdFusion application developed by Portsmouth Naval Shipyard.

· Emergency Command Center (ECC) – The command center used for the Radioactive Emergency Response Organization (RERO) to provide command and control (C2) over all radiological events.

· Enclave – “A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.” (CNSSI 4009, IETF RFC 4949 Ver 2)

· Encryption – “The cryptographic transformation of data to produce ciphertext.” (ISO/IEC 7498-2)

· End Device – A computing device serving as the interface between users and the network system. This relates to only devices owned and managed by PHNSY&IMF in this PWS.

· End of Life (EOL) – Used as an adjective to describe a product that has reached the end of its lifecycle due to the manufacturer and/or vendors no longer manufacturing, selling, or providing support for the product after a specified time frame.

· End User Support – Provision of IT support for users experiencing hardware and software issues, as well as responding to user inquiries.

· Enterprise – When used as a noun and not in a pronoun, refers to “An organization with a defined mission/goal and a defined boundary, using information systems to execute that mission, and with responsibility for managing its own risks and performance...” (CNSSI 4009) Relates to either DoN or PHNSY&IMF as the organization in reference.

· Enterprise Mission Assurance Support Service (eMASS) – Web-based Government off-the-shelf (GOTS) solution that automates a broad range of services for comprehensive, fully integrated cybersecurity management, including controls scorecard measurement, dashboard reporting, and the generation of Risk Management Framework (RMF) for Department of Defense (DoD)…” (https://www.disa.mil/~/media/Files/DISA/Fact-Sheets/eMASS.pdf) Current DoN repository where system/network A&A accreditation packages are tracked, processed, and stored.

· Event – “Any observable occurrence in a network or system.” (NIST SP 800-53 Rev 4) This definition in the PWS pertains to only network or security related tasks.

· Execute Order (EXORD) – “1. An order issued by the Chairman of the Joint Chief of Staff, at the direction of the Secretary of Defense, to implement a decision by the President to initiate military operations. 2. An order to initiate military operations as directed.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended) Used as an authoritative source of compliance in this PWS.

· False Positive – “An instance in which a security tool incorrectly classifies benign content as malicious.” (NIST SP 800-83 Rev 1)

· Federal Information Security Management Act (FISMA) – “Title III of the E-Government Act requiring each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.” (NIST SP 800-63-2)

· Firmware – “Computer programs and data stored in hardware - typically in read-only memory (ROM) or programmable read-only memory (PROM) - such that the programs and data cannot be dynamically written or modified during execution of the programs.” (CNSSI 4009, IETF RFC 4949 Ver 2)

· Fragmentary Order (FRAGORD) – “An abbreviated operation order issued as needed to change or modify an order or to execute a branch or sequel.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended)

· Friendly Force Information Requirement (FFIR) – “Information the commander and staff need to understand the status of friendly force and supporting capabilities.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended)

· Functional Area – An organizational function defined in our departmental RACI (Responsible, Accountable, Consulted, and Informed) charts.

· Functional Authorizing Official (FAO) – Role in the DoN RMF process to “enable accountability for safety, mission areas, products, platforms, and facilities; Commanders, NAVSEASYSCOM, NAVAIRSYSCOM, NAVFACENGCOM, and SPAWARSYSCOM, and Director, SSP are assigned as FAOs for all IT under their purview…” (OPNAVINST 5239.1D)

· Gateway – “An intermediate system (interface, relay) that attaches to two (or more) computer networks that have similar functions but dissimilar implementations and that enables either one-way or two-way communication between the networks.” (CNSSI 4009, IETF RFC 4949 Ver 2)

· General Services Administration (GSA) – The “GSA provides centralized procurement for the federal government…GSA’s acquisition solutions supply federal purchasers with cost-effective high-quality products and services from commercial vendors.” (https://www.gsa.gov/about-us/background-and-history)

· Government Off the Shelf (GOTS) – “A software and/or hardware product that is developed by the technical staff of a Government organization for use by the U.S. Government. GOTS software and hardware may be developed by an external entity, with specification from the Government organization to meet a specific Government purpose, and can normally be shared among Federal agencies without additional cost. GOTS products and systems are not commercially available to the general public. Sales and distribution of GOTS products and systems are controlled by the Government.” (CNSSI 4009, NSA/CSS Policy 3-14) Includes some naval ship maintenance applications and shipyard-developed applications in this PWS.

· Global Maintenance Application Suite (GMAS) – one of the shipyard’s enclaves that is accredited and approved for processing unclassified data and NOT U-NNPI.

· Green Shutdown – a process built into the Windows 10 operating system that applies/installs all updates.

· Hardware – “The material physical components of an information system. See firmware and software.” (CNSSI 4009, IETF RFC 4949 Ver 2)

· Host Based Security System (HBSS) – “A set of capabilities that provide a framework to implement a wide-range of security solutions on hosts. This framework includes a trusted agent and a centralized management function that together provide automated protection to detect, respond, and report host-based vulnerabilities and incidents.” (CNSSI 4009, CNSSI 1011)

· Hotwash – “A debrief conducted immediately after an exercise or test with the staff and participants.” (NIST SP 800-84)

· Identity, Credential, and Access Management – “Programs, processes, technologies, and personnel used to create trusted digital identity representations of individuals and non-person entities (NPEs), bind those identities to credentials that may serve as a proxy for the individual or NPE in access transactions, and leverage the credentials to provide authorized access to an agency‘s resources.” (CNSSI 4009, FICAM Roadmap and Implementation Guidance V2.0)

· Identity Services Engine (ISE) – Commercial off-the-shelf tool. A Cisco network administration product that provides identity and access control.

· Incident – “An occurrence that results in actual or potential jeopardy to the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.” (NIST SP 800-34 Rev 4)

· Incident Management (IM) – “The management and coordination of activities associated with an actual or potential occurrence of an event that may result in adverse consequences to information or information systems.” (NICCS Cybersecurity Glossary)

· Incident Response Plan – “The documentation of a predetermined set of instructions or procedures to detect, respond to, and limit consequences of a malicious cyber attacks against an organization’s information systems(s)” (CNSSI 4009)

· Information Assurance (IA) – “Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities. Note: DoDI8500.01 has transitioned from the term information assurance (IA) to the term cybersecurity.” (CNSSI 4009) Both information assurance and cybersecurity terms are used interchangeably in this PWS.

· Information System (IS) – “A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.” (44 U.S.C. §3502) Note: Information systems may also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems.

· Information System Continuous Monitoring (ISCM) – “Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. Note: The terms “continuous” and “ongoing” in this context mean that security controls and organizational risks are assessed and analyzed at a frequency sufficient to support risk-based security decisions to adequately protect organization information.” (NIST SP 800-137)

· Information Systems Security Engineer (ISSE) – Role in the RMF process. “Individual assigned responsibility for conducting information system security engineering activities.” (CNSSI 4009)

· Information System Security Manager (ISSM) – “Individual responsible for the information assurance of a program, organization, system, or enclave.” (NIST SP 800-30 Rev 1) There is one Command ISSM for PHNSY&IMF that also serves as the Code 109.2 division head. The ISSM ensures that all information security activity within the respective Command is in accordance with DoD and DoN policy and procedures. The ISSM tailors this policy and guidance to meet the specific Command’s requirements.

· Information Technology (IT) – “Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. For purposes of the preceding sentence, equipment is used by an executive agency if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency which (i) requires the use of such equipment or (ii) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. The term information technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources.” (40 USC §1401)

· Information Technology Asset Management System (ITAMS) – Oracle APEX Asset Management tool developed by Code 109. Identifies, tracks, controls, and manages general/specific PHNSY&IMF IT assets for life cycle management.

· Information Technology Project Office (ITPO) – Code 109 office that introduces, supports, monitors, and continuously improves the organizational and individual capabilities to successfully execute and manage various major and non-major IT initiatives through project management training, governance, demand management, and project prioritization. Assisted by the Code 109 Steering Committee that provides support, advocacy, enablement, and partakes in the decision-making and approvals process with the ITPO.

· Information Technology Service Management (ITSM) – Local service management ticket system in use at PHNSY&IMF. An authoritative source of information.

· Integrity – “Assurance that information and systems are not modified by unauthorized parties or in an unauthorized manner. Integrity supports the assurance that data and information are not accidentally or maliciously manipulated, altered, corrupted or destroyed (includes ensuring information non-repudiation and authenticity).” (OPNAVINST 5239.1D) “Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.” (CNSSI 4009; 44 U.S.C. §3542)

· Interface – Applies technically as a noun to mean a “Common boundary between independent systems or modules where interactions take place.” (CNSSI 4009) or as a verb (interfaces) to connect with another system or modules by an interface.

As a noun can also be applied non-technically in this PWS to mean a point where subjects meet and interact.

· Interview – “A type of assessment method that is characterized by the process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or lead to the location of evidence, the results of which are used to support the determination of security control effectiveness over time.” (NIST SP 800-53 Rev 4)

· Intrusion Detection System (IDS) – “A security service that monitors and analyzes network or system events for the purpose of finding, and providing real-time or near real-time warning of, attempts to access system resources in an unauthorized manner.” (NIST SP 800-82 Rev 2)

· Inventory – “(a) The physical or virtual verification of the presence of each item of COMSEC material charged to a COMSEC account. (b) A listing of each item of material charged to a COMSEC account.” (CNSSI 4009, 4005)

· Joint Base Pearl Harbor-Hickam (JBPHH) – Location where primary PWS requirements and tasks are primarily conducted. The Shipyard is located on this property.

· Layered Defense – Use of multiple security controls to protect data and the network. Similar to defense-in-depth approach which is an “Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and dimensions of the organization.” (NIST SP 800-161)

· Life Cycle Management – Management of a system, product, service, project, or other human-made entity from conception through retirement. (Adapted from NIST SP 800-161)

· Local Alarm Monitoring System (LAMAS) – An alarm monitoring system used in the RDC to integrate other disparate alarm systems.

· Maritime Systems Environment (MSE) - “The collection of PMO-IT centrally hosted software applications created to support Shipyard operations. These applications include: AIM, AIMxp, ARCMIS, ATIS, ATMS, Business Objects, COST, DTR, EFEM, MAT, MRQT, NWPS (PMC, QPS,SPF), Payroll, PSS, QDB, SABRS and SUPDESK.”

· Material Asset Tracking (MAT) – Corporate application dealing material ordering.

· Media – “Physical devices or writing surfaces including but not limited to, magnetic tapes, optical disks, magnetic disks, Large-scale integration (LSI) memory chips, printouts (but not including display media) onto which information is recorded, stored, or printed within an information system.” (FIPS PUB 200)

· Media Access Control (MAC)

· Memorandum for Record (MFR) – In-house report for file of a conversation or meeting in order to formalize or document the event that would otherwise not be recorded in writing.

· Memorandum of Agreement (MOA) – “A type of intra-agency, interagency, or National Guard agreement between two or more parties, which includes specific terms that are agreed to, and a commitment by at least one party to engage in action. It includes either a commitment of resources or binds a party to a specific action.” (CNSSI 4009)

· Memorandum of Understanding (MOU) – “A type of intra-agency, interagency, or National Guard agreement between two or more parties, which includes only general understandings between the parties. It neither includes a commitment of resources nor binds a party to a specific action.” (CNSSI 4009)

· Metrics – “Tools designed to facilitate decision making and improve performance and accountability through collection, analysis, and reporting of relevant performance-related data.” (NIST SP 800-55) Code 109 regularly collects metrics for the: CO Cybersecurity Report, NAVSEA 04I IT, Monthly NOSCC, and ITSM.

· Mission Critical – “Any telecommunications or information system that is defined as a national security system (Federal Information Security Management Act (FISMA) of 2002) or processes any information the loss, misuse, disclosure, or unauthorized access to or modification of, would have a debilitating impact on the mission of an agency.” (CNSSI 4009; NIST SP 800-60 Vol 1 Rev 1) Mission critical can also refer to PHNSY&IMF operations that support the capability of the DoN fleet.

· Naval Information Warfare Command (NIWC) – Otherwise known as NAVWAR. One of the DoN’s five system commands that “identifies, develops, delivers and sustains information warfighting capabilities supporting naval, joint, coalition and other national missions.” (https://www.public.navy.mil/navwar/Pages/Organization.aspx) PHNSY&IMF locally works with the NIWC Pacific office in Hawaii.

· Naval Sea Systems Command (NAVSEA) – Largest of the DoN’s five system commands and is comprised of command staff, headquarters directorates, affiliated Program Executive Offices (PEOs) and numerous field activities that “engineer, build, buy and maintain ships, submarines and combat systems that meet the Fleet’s current and future operational requirements.”

PHNSY&IMF is one of the field activities within NAVSEA, and one of the two Echelon IIs that is reported to.

· Navy Authorizing Official (NAO) – Role in the DoN RMF process. “Commander, FLTCYBERCOM is designated as the NAO. The NAO role at FLTCYBERCOM will manage and maintain oversight over community risk and the DoDIN.” (OPNAVINST 5239.1D)

· Navy Cyber Defense Operations Command (NCDOC) – DoN cyber team that executes defensive cyberspace operations through proactive network defense.

· Navy Marine Corps Intranet (NMCI) – DoN shore-based enterprise network in the continental United States and Hawaii, providing a single integrated, secure IT environment for reliable, stable information transfer.

· Navy Qualified Validator (NQV) – DoN role in the RMF process. “The validator performs a vital role as an independent third party who assesses and validates that the system has implemented the approved security control baseline. In this role, the validator acts as a trusted agent to the SCA.” (https://www.doncio.navy.mil/mobile/ContentView.aspx?ID=9196&TypeID=21)

· Network – “Information system(s) implemented with a collection of interconnected components. Such components may include routers, hubs, cabling, telecommunications controllers, key distribution centers, and technical control devices.” (CNSSI 4009; NIST SP 800-53 Rev 4)

· Network Attached Storage (NAS) – File-level computer data storage server connected to a computer network providing data access to a heterogeneous group of clients.

· Network Defense – “Programs, activities, and the use of tools necessary to facilitate them (including those governed by NSPD-54/HSPD-23 and NSD-42) conducted on a computer, network, or information or communications system by the owner or with the consent of the owner and, as appropriate, the users for the primary purpose of protecting (1) that computer, network, or system; (2) data stored on, processed on, or transiting that computer, network, or system; or (3) physical and virtual infrastructure controlled by that computer, network, or system. Network defense does not involve or require accessing or conducting activities on computers, networks, or information or communications systems without authorization from the owners or exceeding access authorized by the owners.” (CNSSI 4009; PPD 20)

· Network Maps – “A representation of the internal network topologies and components down to the host/device level to include but not limited to: connection, sub-network, enclave, and host information.” (CNSSI 4009)

· Network Operations and Security Center (NOSCC) – provides real-time operational network intrusion detection and perimeter defense through continuous monitoring.

· Non-Classified Internet Protocol Router Network (NIPRNET)

· Objective Quality Evidence (OQE) – Material information/artifacts that supports a conclusion or fact. A statement of fact, either quantitative or qualitative, pertaining to the quality of a product or service based on observations, measurements, or tests that can be verified.

· Objects – “Passive information system-related entity (e.g., devices, files, records, tables, processes, programs, domains) containing or receiving information. Access to an object (by a subject) implies access to the information it contains.” (CNSSI 4009; NIST SP 800-53 Rev 4)

· Occupational Safety and Health Administration (OSHA) – OSHA is part of the United States Department of Labor. The administrator for OSHA is the Assistant Secretary of Labor for Occupational Safety and Health. OSHA's administrator answers to the Secretary of Labor, who is a member of the cabinet of the President of the United States. Congress created the Occupational Safety and Health Administration (OSHA) to ensure safe and healthful working conditions for working men and women by setting and enforcing standards and by providing training, outreach, education and assistance. (https://www.osha.gov/aboutosha)

· Open-Source Intelligence (OSINT) – “Relevant information derived from the systematic collection, processing, and analysis of publicly available information in response to known or anticipated intelligence requirements.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended)

· Operating System – “The software “master control application” that runs the computer. It is the first program loaded when the computer is turned on, and its main component, the kernel, resides in memory at all times. The operating system sets the standards for all application programs (such as the Web server) that run in the computer. The applications communicate with the operating system for most user interface and file management operations.” (NIST SP 800-44 Version 2)

· Operation Order (OPORD) – “A directive issued by a commander to subordinate commanders for the purpose of effecting the coordinated execution of an operation.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended)

· Organization(s) - An entity of any size, complexity, or positioning within an organizational structure (e.g., a federal agency, or, as appropriate, any of its operational elements). (CNSSI 4009; NIST SP 800-37 Rev 1) The organization in this PWS is PHNSY&IMF. An external organization may refer to any agency or command outside of PHNSY&IMF, which can include but is not limited to: NAVSEA, DoN, DoD, and DLA.

· Outage – Period of time that a system fails to provide or perform its primary function.

· Package – Relates to an “accreditation package” in the RMF process. “Product comprised of a system security plan (SSP) and a report documenting the basis for the accreditation decision.” (CNSSI 4009) PHNSY&IMF submits accreditation packages in the Navy eMASS site.

· Password – “A string of characters (letters, numbers, and other symbols) used to authenticate an identity or to verify access authorization.” (NIST SP 800-82 Rev 2)

· Patch – “A software component that, when installed, directly modifies files or device settings related to a different software component without changing the version number or release details for the related software component.” (CNSSI 4009; ISO/IEC 19770-2)

· Penetration Testing – “A method of testing where testers target individual binary components or the application as a whole to determine whether intra or intercomponent vulnerabilities can be exploited to compromise the application, its data, or its environment resources.” (NIST SP 800-95) Applies to software requirements in this PWS.

· Personal Protective Equipment (PPE) – “Mission-specific protective clothing and equipment provided to shield or isolate selected personnel from a particular chemical, biological, radiological, and some nuclear hazards.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended) Applies to mainly cable installation requirements in this PWS.

· PHNSY&IMF Account Management (PAM) – Oracle APEX Account Management tool developed by Code 109. Identifies, tracks, controls, and manages general/specific access and documents to verify whether a user account is authorized to access PHNSY&IMF systems, networks, and applications.

· Personal Identity Verification (PIV) – “A physical artifact (e.g., identity card, “smart” card) issued to a government individual that contains stored identity credentials (e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the claimed identity of the cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an automated process (computer readable and verifiable).” (CNSSI 4009; CNSSI 1300) Also referred to as the authentication certificate on the CAC.

· Physical Security – “That part of security concerned with physical measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard them against espionage, sabotage, damage, and theft.” (Office of the Chairman of the Joint Chiefs of Staff, “DOD Dictionary of Military and Associated Terms,” as amended) The SF701 is a security form that details security check requirements for physical spaces.

· Plan of Action and Milestones (POAM) – “A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones.” (CNSSI 4009; OMB Memorandum 2-01; NIST SP 800-37 Rev 1)

· Platform Information Technology (PIT) - Information Technology, both hardware and software, that is physically part of, dedicated to, or essential in real-time to the mission performance of Special Purpose systems.

One of the services areas within the PWS.

· Privilege – “A right granted to an individual, a program, or a process.” (CNSSI 4009)

· Probability of Occurrence – “A weighted factor based on a subjective analysis of the probability that a given threat is capable of exploiting a given vulnerability or a set of vulnerabilities.” (CNSSI 4009; NIST SP 800-30 Rev 1)

· Profiling – “Measuring the characteristics of expected activity so that changes to it can be more easily identified.” (NIST SP 800-61 Rev 2)

· Project Management Body of Knowledge (PMBOK) – A set of project management standard terminology and guidelines overseen by the Project Management Institute.

· Protected Distribution System (PDS) – “Wire line or fiber optic system that includes adequate safeguards and/or countermeasures (e.g., acoustic, electric,…