organization-defined time period

No definition is given in NIST SP 800-171r3. The term is attested in use at 16 citations in that document; a definition is pending curation.

Increment 2: attested in 800-171r3 without a glossary definition.

A placeholder variable embedded within a security or privacy control statement—a species of **organization-defined parameter (ODP)**—that reserves a duration value for the implementing organization to specify during the tailoring process. It is "the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a predefined list provided as part of the control or control enhancement." In practice, the standards body intentionally leaves the duration blank because the correct threshold differs by context, risk tolerance, and applicable regulatory constraints; organization-defined parameters are used in NIST SP 800-53 controls "to provide flexibility to federal agencies in tailoring controls to support specific organizational missions or business functions and to manage risk." Once filled in, the chosen value becomes part of the enforceable requirement and is subject to assessment: once ODPs have been defined, they become part of the security requirement and can be assessed as such, and they help simplify assessments by providing greater specificity and

DR-088 backfill from the noun definition column

A **time-typed organization-defined parameter (ODP)** — a placeholder embedded in a security or privacy control statement that a deploying organization must replace with a concrete duration or interval during the control-tailoring process. Per the NIST Computer Security Resource Center glossary (sourced from NIST SP 800-37 Rev. 2 and SP 800-53 Rev. 5), an organization-defined control parameter is "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." "Organization-defined time period" is the time-dimensioned instance of that class of parameter: many NIST controls are not "complete" as published but require "fill in the blanks," and those blanks are called Organization-Defined Values or Organization-Defined Parameters. In practice it appears across a wide range of control families — account management, audit retention, identifier reuse, lockout windows, and more — wherever the standard mandates a time-bounded obligation but deliberately leaves the specific duration to organizational risk and policy judgment: for example, enforcing a limit on consecutive invalid logon attempts "during a [Assignment: organization-defined time period]" and then locking the account "for [Assignment: organization-defined time period]"; preventing "the reuse of identifiers for [Assignment: organization-defined time period]"; and disabling a user identifier "after [Assignment: organization-defined time period] of inactivity."

Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.