Cyber Threat Level
Right Column
Definitions
The following definitions of administrative and technical terms are provided to assist agencies in their application of information security and privacy policy. These definitions were formally located in section 4840 through 4845 of the State Administrative Manual. New definitions are developed through workgroups and added to this glossary following a comprehensive vetting process.
| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z |
Alert. Notification that a potential disaster situation is imminent, exists, or has occurred; usually includes a directive for personnel to stand by for possible activation.
Application Recovery. The component of Disaster Recovery that deals specifically with the restoration of business system software and data after the processing platform has been restored or replaced.
Related Terms: Business System Recovery
Backup (Data). A process by which data is copied in some form so as to be available and used if the original data from which it originated is lost, destroyed or corrupted.
Business Continuity Management Program. An ongoing governance process supported by senior management and resourced to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and plans, and ensure continuity of products/services through exercising, rehearsal, testing, training, maintenance.
Business Continuity Plan (BCP). A plan that documents arrangements and procedures that enable an organization to respond to an event that lasts for an unacceptable period of time and return to performing its critical business functions after an interruption.
Related Terms: Business resumption plan, continuity plan, contingency plan, disaster recovery plan, recovery plan
Business Impact Analysis (BIA). A process designed to prioritize business functions by assessing the potential quantitative (financial) and qualitative (non-financial) impact that might result if an organization was to experience a disruption.
Cold Site. An alternate facility that already has in place the environmental infrastructure required to recover critical business functions or information systems, but does not have any pre-installed computer hardware, telecommunications equipment, communication lines, etc. These must be provisioned at time of disaster.
Related Terms: Alternate Site, Hot Site, Interim Site, Internal Hot Site, Recovery Site, Warm Site
Communications Recovery. The component of Disaster Recovery which deals with the restoration or rerouting of an organization’s telecommunication network, or its components, in the event of loss.
Confidential Information. Information maintained by state agencies that is exempt from disclosure under the provisions of the California Public Records Act (Government Code Sections 6250-6265) or other applicable state or federal laws. See SAM Section 5320.5.
Contact List. A list of team members and/or key personnel, including their backups, to be contacted during an event. The list will include the necessary contact information (i.e. home phone, pager, cell, etc.) and in many cases it is considered confidential.
Related Terms: Call Tree
Critical Application. An application that is so important to the agency that its loss or unavailability is unacceptable. With a critical application, even short-term unavailability of the information provided by the application would have a significant negative impact on the health and safety of the public or state workers; on the fiscal or legal integrity of state operations; or on the continuation of essential agency programs.
Custodian of Information. An employee or organizational unit (such as a data center or information processing facility) acting as a caretaker of an automated file or data base.
Disaster. A condition in which an information asset is unavailable, as a result of a natural or man-made occurrence, that is of sufficient duration to cause significant disruption in the accomplishment of agency program objectives, as determined by agency management.
Disaster Recovery. The ability of an organization to respond to a disaster or an interruption in services by implementing a disaster recovery plan to stabilize and restore the organization’s critical functions.
Disaster Recovery Plan (DRP). The management approved document that defines the resources, actions, tasks and data required to manage the technology recovery effort. Usually refers to the technology recovery effort. This is a component of the Business Continuity Management Program.
Related Terms: Operational Recovery Plan (ORP), Business Continuity Management Plan, Recovery Plan, Business Resumption Plan
Disaster Recovery Planning. The technical component of business continuity planning.
Hardening. A defense strategy to protect against attacks by removing vulnerable and unnecessary services, patching security holes, and securing access controls.
Hot Site. An alternate facility that already has in place the computer, telecommunications, and environmental infrastructure required to recover critical business functions or information systems.
Related Terms: Alternate Site, Cold Site, Warm Site
Information Assets. (1) All categories of automated information, including (but not limited to) records, files, and data bases; and (2) information technology facilities, equipment (including personal computer systems), and software owned or leased by state agencies.
Information Integrity. The condition in which information or programs are preserved for their intended purpose; including the accuracy and completeness of information systems and the data maintained within those systems.
Information Security. The protection of information from a wide range of threats in order to ensure business continuity, minimizes business risk, and maximizes return on investments and business opportunities. Information exists in many forms: printed or written on paper, stored electronically, transmitted by post or electronic means, on films, spoken.
Mission-Critical Applications. Applications that support business activities or processes that could not be interrupted or unavailable for the Recovery Time Objective (RTO) defined by the agency without significantly jeopardizing the organization.
Related terms: Critical Application, Recovery Time Objective (RTO)
Mission Critical Activities. The critical operational and/or business support activities (either provided internally or outsourced) required by the organization to achieve its objective(s) i.e. services and/or products.
Mission Critical Business Functions. The critical operational and/or business support functions that could not be interrupted or unavailable for more than a mandated or predetermined timeframe without significantly jeopardizing the organization. An example of a business function is a logical grouping of processes/activities that produce a product and/or service such as Accounting, Staffing, Customer Service, etc.
Related Terms: Critical Business Function, Essential Functions, Critical Resources
Mobilization of Personnel. To organize (people, resources, etc.) for active service or use in any emergency, drive, etc.
Non-State Entity. A business, organization, or individual that is not a State entity, but requires access to State information assets in conducting business with the State. (This definition includes, but is not limited to, researchers, vendors, consultants, and their employees, and entities associated with federal and local government and other states.)
Outsource. The procuring of services or products from an outside supplier or manufacturer due to lack of resources, knowledge, or timeliness, or to cut costs.
Related Terms: Outside Source
Owner of Information. An organizational unit having responsibility for making classification and control decisions regarding an automated file or data base.
Peer-to-Peer Technology. Computer software, file sharing program, or protocol, other than computer and network operating system, that has as its primary function the capability to allow the computer on which the technology is used to designate files available for transmission to another computer using the technology, to transmit files directly to another computer using the technology, and to request the transmission of files from another computer using the technology.
Physical Security. The measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard them against unauthorized access, damage, and theft.
Privacy. The right of individuals and organizations to control the collection, storage, and dissemination of information about themselves.
Public Information. Any information prepared, owned, used, or retained by a state agency and not specifically exempt from the disclosure requirements of the California Public Records Act (Government Code Sections 6250-6265) or other applicable state or federal laws.
Recovery Point Objective (RPO). The maximum amount of data loss an organization can sustain during an event.
Recovery Prioritization. The ordering of critical activities and their dependencies are established during the Business Impact Analysis (BIA) and Strategic-planning phase. The continuity plans will be implemented in the order necessary at the time of the event.
Related Terms: Priority Classification, Prioritization
Recovery Strategy. An approach by an organization that will ensure its recovery and continuity in the face of a disaster or other major outage. Plans and methodologies are determined by the organizations strategy. There may be more than one solution to fulfill an organization’s strategy. Examples: Internal or external hot-site, or cold-site, Alternate Work Area reciprocal agreement, Mobile Recovery, Quick Ship / Drop Ship, Consortium-based solutions, etc.
Related Terms: Business Continuity Strategy, Recovery Strategy, Continuity Strategy, Resumption Strategy
Recovery Team. A team responsible for developing, maintaining, and activating the business recovery procedures and complying with the organization’s BCM program.
Related Terms: Disaster Recovery Team, Key Personnel, IT Personnel, Business Recovery Teams
Recovery Time Objective (RTO). The period of time within which systems, applications, or functions must be recovered after an outage (e.g. one business day). RTO’s are used as the basis for the development of recovery strategies, and as a determinant as to whether or not to implement the recovery strategies during a disaster situation.
Related Terms: Maximum Allowable Downtime/Outage.
Risk. The likelihood or probability that a loss of information assets or breach of security will occur.
Risk Analysis. The process of identifying the vulnerabilities and threats to an organization by assessing the critical functions necessary for an organization to continue business operations, and defining the controls in place to reduce organization exposure and evaluating the cost for such controls.
Related Terms: Risk Assessment, Business Impact Analysis, Vulnerability Assessment, Threat Assessment
Risk Management. The process of taking actions to avoid risk or reduce risk to acceptable levels.
Sensitive Information. Information maintained by state agencies that requires special precautions to protect it from unauthorized modification, or deletion. See SAM Section 5320.5. Sensitive information may be either public or confidential (as defined above).
User of Information. An individual having specific limited authority from the owner of information to view, change, add to, disseminate or delete such information.
