critical application
An application classification assigned through impact analysis to any software system whose loss of availability, loss of integrity, or unauthorized access would materially impair an organization's mission, revenue, regulatory standing, or public safety obligations. It is distinguished from ordinary applications by the severity and breadth of harm its failure produces — not by its technical architecture — and the classification is operationalized by mandating a proportionately higher tier of security controls: stronger access governance, elevated monitoring priority, stricter change approval, and dedicated incident-response treatment. In federal and compliance frameworks, the category maps directly to what OMB Circular A-130 and NIST SP 800-18 call a "major application," meaning one that "requires special attention to security due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application," because "certain applications, because of the information in them, require special management oversight and should be treated as major."
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An application classification assigned through impact analysis to any software system whose loss of availability, loss of integrity, or unauthorized access would materially impair an organization's mission, revenue, regulatory standing, or public safety obligations. It is distinguished from ordinary applications by the severity and breadth of harm its failure produces — not by its technical architecture — and the classification is operationalized by mandating a proportionately higher tier of security controls: stronger access governance, elevated monitoring priority, stricter change approval, and dedicated incident-response treatment. In federal and compliance frameworks, the category maps directly to what OMB Circular A-130 and NIST SP 800-18 call a "major application," meaning one that "requires special attention to security due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application," because "certain applications, because of the information in them, require special management oversight and should be treated as major."Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.