organization-defined personnel
An organization-defined parameter (ODP) — specifically one whose value is a set of human recipients identified by job title, functional role, or organizational position — that an implementing organization must supply during the control-tailoring process to make a security or privacy control requirement complete and enforceable. It is the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a predefined list. Across NIST SP 800-53 and related frameworks, the assignment operation allows an organization to assign a specific, organization-defined value to the control — for example, assigning a list of roles to be notified. In practice the expression appears throughout policy-dissemination, notification, approval, and training controls — such as developing, documenting, and disseminating personnel security policy to [Assignment: organization-defined personnel or roles] or requiring third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations — where each implementing organization
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An organization-defined parameter (ODP) — specifically one whose value is a set of human recipients identified by job title, functional role, or organizational position — that an implementing organization must supply during the control-tailoring process to make a security or privacy control requirement complete and enforceable. It is the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a predefined list. Across NIST SP 800-53 and related frameworks, the assignment operation allows an organization to assign a specific, organization-defined value to the control — for example, assigning a list of roles to be notified. In practice the expression appears throughout policy-dissemination, notification, approval, and training controls — such as developing, documenting, and disseminating personnel security policy to [Assignment: organization-defined personnel or roles] or requiring third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations — where each implementing organizationDR-088 backfill from the noun definition column