R 24-37.5-403.4 - Definitions

ACSP - Agency Cyber Security Plan.

Access Control - Access controls are typically logical controls designed into the hardware and software of a computing system. Identification is accomplished both under program control and by using physical controls.

Agency Chief Information Officer (Agency CIO) - A role delegated to a knowledgeable employee within an nonconsolidated agency, responsible for approving the agency cyber security plan.

CCSP - Colorado Cyber Security Program.

Change Control - Process for controlling modifications to hardware, firmware, software and documentation to ensure the information system is consistently available to users and the system and data it contains are protected from improper modification before, during, and after the system implementation.

Configuration Management - Process for consciously configuring hardware, firmware, software, and documentation to ensure the information system is protected against improper use or unintended failure before, during and after system implementation.

Consolidated Agency or Agencies - All public agencies whose information technology and information security responsibilities were consolidated within the Governor's Office of Information Technology.

Cyber Security Incident - Any event, suspected event, condition, and/or vulnerability that could pose a threat to the confidentiality, integrity, or availability of systems, applications or data.

ECSP - Enterprise Cyber Security Plan -The consolidated, integrated cyber security plan created by the Governor's Office of Information Security for all consolidated agencies in compliance with these rules.

Enclave - A security Enclave is a logical boundary surrounding all resources that are controlled and protected. The protected resources are called a domain (or enclave or protected subnetwork). There may be overlapping domains of varying protection, so that the most sensitive resources are in the innermost domain, which is the best protected. Protecting the security perimeter may be physical controls, identification and authentication, encryption, and other forms of access control.

Event - An event is any observable security occurrence in a system and/or network.

Firewall - A method of guarding a private network by analyzing the data and applying access control rules.

General Support System - An interconnected information resource under the same direct management control that shares common functionality.

Information Security Officer (ISO) - A role delegated to a knowledgeable employee or contractor within an agency, responsible for supporting the agency cyber security plan.

Information Security Operations Center (ISOC) - Statewide cyber security monitoring and analysis team responsible for security operations for shared state services.

Individual Accountability - Requires individual users to be held accountable for their actions after being notified of the rules of behavior in the use of the system and the penalties associated with the violation of those rules.

Intrusion Detection - Intrusion detection is the process of identifying attempts to penetrate a system and gain unauthorized access.

Major Application or Major Information System - An application that requires special attention to security due to the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to, or modification of, the information in the application.

Non-Consolidated Agency or Agencies - Those public agencies whose information technology and information security responsibilities were not consolidated within the Governor's Office of Information Technology but are required to comply with these rules.

Patch - Otherwise known as a software update. A patch is a piece of code that is added to software in order to fix a bug or problem. It is used most frequently as a temporary correction between two version releases.

POA&M - Plan of Action and Milestones: consists of agency remediation plans to close compliance gaps and mitigate known risks to communications and information resources.

Remote Access - Remote access is the ability to get access to a computer or a network from a remote distance. In corporations, people at branch offices, telecommuters, and people who are traveling may need access to the corporation's network.

Risk - The possibility of harm or loss to any software, information, hardware, administrative, physical, communications, or personnel resource within an automated information system or activity.

Risk Assessment - A process used to identify and evaluate risks and their potential effects.

Risk Management - The ongoing process of assessing the risk to automated information resources and information, as part of a risk-based approach used to determine adequate security for a system by analyzing the threats and vulnerabilities and selecting appropriate cost-effective controls to achieve and maintain an acceptable level of risk.

Security Incident - Means an accidental or deliberate event that results in or constitutes an imminent threat of unauthorized access, loss, disclosure, modification, disruption, or destruction of communication and information resources.

SDLC - System Development Life Cycle: a process that each agency deploys to manage the acquisition, development, deployment, maintenance and replacement of systems.

State CIO - The person responsible for overseeing the operations of the Governor's Office of Information Technology and for delivering information technology, including information security, services to consolidated agencies within the executive branch (as defined in 24-37.5-102(1))

Notes

R 24-37.5-403.4