comprehensive authorized software process
nounverified·updated Oct 3, 2026
A compositional phrase, not a term of art. The words "comprehensive," "authorized software," and "process" each carry their ordinary security-configuration meanings — respectively, covering multiple levels of abstraction, limiting execution to explicitly permitted code, and the organizational lifecycle (identification, enforcement, and periodic review) for doing so. The phrase describes the goal that an allowlisting program should span all software layers (applications, modules, APIs, system services, kernel functions, drivers, etc.) rather than operating only at the application level, but it is not defined, scoped, or used as a standalone concept anywhere in the standards corpus.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A compositional phrase, not a term of art. The words "comprehensive," "authorized software," and "process" each carry their ordinary security-configuration meanings — respectively, covering multiple levels of abstraction, limiting execution to explicitly permitted code, and the organizational lifecycle (identification, enforcement, and periodic review) for doing so. The phrase describes the goal that an allowlisting program should span all software layers (applications, modules, APIs, system services, kernel functions, drivers, etc.) rather than operating only at the application level, but it is not defined, scoped, or used as a standalone concept anywhere in the standards corpus.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.