§5727 Definitions

Summary

Defines key information-security words used in the subchapter so everyone knows what they mean for VA rules. Availability means making sure people can get and use information when they need it. Confidentiality means keeping access and sharing of information limited to authorized people, protecting privacy and business secrets. Control techniques are methods to guide how information systems run to meet security rules. Data breach means losing, having stolen, or otherwise having unauthorized access to sensitive personal information, not including access that is part of someone’s job. Data breach analysis is the process to see if a breach led to misuse of that sensitive information. Fraud resolution services help a person recover and fix their credit after identity theft. Identity theft has the meaning given in section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a). Identity theft insurance pays costs tied to fixing identity theft, such as travel, notary and postage fees, lost wages, and legal costs. Information owner is the agency official who controls specific information and sets rules for its handling. Information resources are information in any form plus related people, equipment, money, and technology. Information security means protecting information and systems from unauthorized actions so they stay accurate, private, and available. Information security requirements are rules made under law or set by the Secretary of Commerce, NIST, OMB, and, for national security systems, the President. Information system is a set of resources organized to collect, process, store, use, share, or dispose of information. Integrity means guarding against improper changes or destruction and ensuring information is authentic. National security system is an information system protected by special policies because it handles classified defense or foreign policy information. Plan of action and milestones is the OMB quarterly reporting plan that lists a security weakness, who will fix it, needed resources, dates, milestones, source, and status. Principal credit reporting agency has the meaning in FCRA section 603(p) (15 U.S.C. 1681a(p)). Security incident is an event that did or could harm VA assets or sensitive information or that breaks VA security rules. Sensitive personal information is any agency-held info about a person, including education, financial, medical, criminal or employment history, and identifiers like name, Social Security number, birth data, mother’s maiden name, or biometrics. Subordinate plan or system security plan is a plan that describes the security controls for a network, facility, system, or group of systems within its accreditation boundary. Training is teaching someone how to perform a security task or learn the common body of information-security knowledge. VA National Rules of Behavior are the Department’s rules describing employees’ responsibilities and expected behavior for using information systems. VA sensitive data is any Department data that needs protection because its disclosure, change, or destruction could harm VA’s mission, includes proprietary data, or records about people that must stay confidential.