organization-defined security-relevant information

No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.

Increment 2: attested in 800-171r3 without a glossary definition.

A parameterized placeholder used in NIST SP 800-53 access-control statements, combining the standard `[Assignment: organization-defined …]` tailoring syntax with the defined term "security-relevant information" — information within a system that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data. The full expression does not coin a new concept; it instructs each organization to enumerate, from that category, the specific assets it will protect — such as filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists. In practice it appears in control AC-3(5), where the information system prevents access to `[Assignment: organization-defined security-relevant information]` except during secure, non-operable system states, leaving the exact scope of that information for each organization to specify in its System Security Plan.

DR-088 backfill from the noun definition column

A tailorable control parameter — an open slot in a security or privacy control statement — that an implementing organization fills in at the time of control tailoring by enumerating the specific subset of system information whose sensitivity to security-function integrity warrants protection under that control. The parent concept, *security-relevant information*, is defined by NIST as "information within the system that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data." Canonical examples include access control lists, filtering rules for routers or firewalls, configuration parameters for security services, and cryptographic key management information. In practice the full expression appears as an *Assignment* parameter inside a control statement — specifically, NIST SP 800-53 control AC-3(5) reads: "Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states" — meaning each organization must supply its own enumerated list of which security-relevant data assets that control governs, rather than accepting a single universal list; an organization-defined control parameter is formally "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list provided as part of the control or control enhancement."

Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.