§5727 Definitions

Summary

Gives plain meanings for words used about information security at the Department. It tells what each key term refers to so people know what the rules talk about. Availability means timely, reliable access to and use of information. Confidentiality means keeping access and sharing rules so privacy and secret business information stay protected. Control techniques means methods to guide information systems so they follow subchapter III of chapter 35 of title 44 and other security rules. Data breach means loss, theft, or other unauthorized access (not just something incidental to doing a job) to data with sensitive personal information, in electronic or paper form, that could harm its confidentiality or integrity. Data breach analysis means the process used to decide if stolen or exposed sensitive data was misused. Fraud resolution services means help for someone to recover and repair their credit after identity theft. Identity theft has the meaning given in section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a). Identity theft insurance means a policy that pays costs like travel, notary and postage fees, lost wages, and legal fees to fix the effects of identity theft. Information owner means the agency official who has authority and responsibility for certain information and how it is handled, which can cover linked systems. Information resources means information in any form plus related people, equipment, money, and technology. Information security means protecting information and systems from unauthorized access, use, change, or destruction so they keep integrity, confidentiality, and availability. Information security requirements are the security rules made under law or directed by the Secretary of Commerce, the National Institute of Standards and Technology, and the Office of Management and Budget, and for national security systems, by the President. Information system means a set of information resources organized to collect, process, use, share, or dispose of information, whether automated or manual. Integrity means guarding against improper changes or destruction and includes non-repudiation and authenticity. National security system means an information system protected for handling information that law or Executive Order says must be classified for national defense or foreign policy. Plan of action and milestones means the plan used for OMB quarterly reports that describes the security weakness, who must fix it, estimated resources by fiscal year, scheduled completion and key milestones with dates, any changed milestone dates, where the weakness was found, and the status of fixes. Principal credit reporting agency means a consumer reporting agency as described in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)). Security incident means an event that has or could have caused loss or damage to Department assets or sensitive information, or that breaks Department security rules. Sensitive personal information means any agency-held information about an individual, such as education, financial transactions, medical, criminal or job history, and identifiers that can trace identity like name, social security number, birth data, mother’s maiden name, or biometric records. Subordinate plan (or system security plan) means a plan that lists the security controls planned or in place for networks, facilities, systems, or groups of systems within an accreditation boundary. Training means a learning activity that teaches a person a specific information security task or the common information security knowledge. VA National Rules of Behavior means the Department’s rules that explain staff responsibilities and expected behavior when using information systems. VA sensitive data means Department data in any form that needs protection because improper use or disclosure could harm mission work, reveal proprietary information, or expose records about people that must be kept confidential.