Glossary · Nouns · S
L1 — paginated flat list. Pick a POS, pick a letter.
TermTypeDefinitionClassificationsUpdated
system accountnounMWEA credentialed identity established on a system through which a user, process, or service is authorized to access system resources. The account carries the attributes that govern that access - its authorized users, its group and role membership, and its access privileges - and is managed across a lifecycle of creation, enablement, modification, disablement and removal. Account types are enumerated by the controlling framework rather than assumed: NIST SP 800-171r3 and SP 800-53 name individual, group, temporary, system, guest, anonymous, emergency, developer and service accounts, several of which an organization may prohibit outright because of the risk they carry. The phrase is a term of art and it is the umbrella term rather than one of the types: "system" appears in that list as a single account type, while a privileged account is defined as a system account holding the authorizations of a privileged user.IdentityRegulated
system account attributenounMWEA descriptive noun phrase, not a standalone defined term, referring to the set of properties or metadata fields that an organization formally assigns to any managed access account — regardless of account type (individual, shared, group, guest, emergency, service, etc.) — that collectively govern how that account may be used. Organizations may define access privileges or other attributes by account or type of account, with examples including restrictions on time of day, day of week, and point of origin. When defining these attributes, organizations consider both system-related requirements and mission/business requirements — such as scheduled maintenance windows or time-zone differences — making the attribute set the formal specification used to create, manage, and audit accounts under an identity governance program.RequirementRegulated
System AdministrationnounMWEThe process of maintaining, configuring, and operating computer systems.Process
System AdministratornounMWEIndividual responsible for the installation and maintenance of an information system, providing effective information system utilization, adequate security parameters, and sound implementation of established Information Assurance policy and procedures.Role
system and network monitoringnounMWESystem and Network Monitoring supports all activities related to the real-time monitoring of systems and networks for optimal performance. System and network monitoring describes the use of tools and observation to determine the performance and status of information systems and is closely tied to other Information and Technology Management sub-functions.Capability
System AssetsnounMWEAny software, hardware, data, administrative, physical, communications, or personnel resource within an information system.System
system behaviornounMWEThe observable and operational characteristics of a computing system — encompassing its processes, configurations, resource usage, and responses to inputs — that collectively define how it functions at runtime. In security and compliance contexts, it is used as a reference baseline: controls are designed to preserve expected system behavior (e.g., by restricting commands that could alter it) or to detect when behavior deviates from that baseline, which may indicate compromise, misconfiguration, or unauthorized privileged action. Authority documents treat nominal or "typical" system behavior as a well-defined pool from which execution profiles are drawn, against which anomalous activity is measured. Frameworks such as CIS Benchmarks use the phrase directly, noting that hardening configurations "can significantly alter system behavior," and post-compromise threat models describe attackers modifying kernel parameters or device interfaces to alter system behavior in ways that are difficult to distinguish from legitimate administration.verified
system boundariesnounMWEThe specific aspects of an entity's infrastructure, software, people, procedures, and data necessary to perform a function (such as producing, manufacturing, or distributing a product) or provide a service. When systems for multiple functions or services share aspects, infrastructure, software, people, procedures, and data, the systems will overlap, but the boundaries of each system will differ.Limiting TermRegulated
System CallnounMWEan instruction that interrupts the program being executed and passes control to the supervisorverified
System ClocknounMWEan electronic device in a computer that issues a steady high-frequency signal that synchronizes all the internal componentsverified
System CommandnounMWEa computer user's instruction (not part of a program) that calls for action by the computer's executive programverified
system componentnounMWEA discrete, identifiable information technology asset that represents a building block of a system and may include hardware, software, and firmware. [26]Asset ComponentRegulatedCUI
system configurationnounMWEThe setting of various switches and jumpers for hardware and the defining of values of parameters for software.Data
system configuration settingnounMWEA modifiable parameter — residing in the hardware, software, or firmware of an information system — whose value affects the security posture, privacy posture, or operational behavior of that system. Configuration settings are "the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system," and the qualifier *system* situates that parameter at the level of the whole system rather than a sub-component or application in isolation. Covered products range from mainframe computers and servers to mobile devices and applications; concrete examples include registry settings, account and file permissions, and settings for protocols, ports, services, and remote connections. In practice, organizations establish and document these settings to reflect the most restrictive mode consistent with operational requirements, deriving system-specific values from organization-wide baselines that then become part of the system's configuration baseline.Control
System Development Life CyclenounMWEThe scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation.Process
system development methodologynounMWEMethodologies developed through software engineering to manage the complexity of system development. Development methodologies include software engineering aids and high-level design analysis tools.Process
system documentationnounMWEDetailed information about a computer system its architecture, design, data flow, and programming logic.ArtifactInternalIP
System ErrornounMWEan instruction that is either not recognized by an operating system or is in violation of the procedural rulesverified
system eventnounMWEAn occurrence that could lead to the loss of, or disruption to, operations, services, or functions and could result in an entity's failure to achieve its system objectives. Such an occurrence may arise from actual or attempted unauthorized access or use by internal or external parties and ( a ) impair (or potentially impair) the availability, integrity, or confidentiality of information or systems; ( b ) result in unauthorized disclosure or theft of information or other assets or the destruction or corruption of data; or ( c ) cause damage to systems. Such occurrences also may arise from the failure of the system to process data as designed or from the loss, corruption, or destruction of data used by the system.EventRegulated
System hardeningnounMWEConfiguring all configurable items within an entire system to reduce the host’s security weaknesses.ProcessRegulated
System High ModenounMWEInformation systems security mode of operation wherein each user, with direct or indirect access to the information system, its peripherals, remote terminals, or remote hosts, has all of the following: a. valid security clearance for all information within an information system; b. formal access approval and signed nondisclosure agreements for all the information stored and/or processed (including all compartments, subcompartments and/or special access programs); and c. valid need-to-know for some of the information contained within the information system.ProcessRegulatedCUI
system implementationnounMWEThe process of putting a planned system into action; the stage of systems development in which hardware and software are acquired, developed and installed, the system is tested and documented, people are trained to operate and used the system, and an organization converts to the use of a newly developed system.Process
system incidentnounMWEA system event that requires action on the part of entity management to prevent or reduce the impact of the event on the entity's achievement of its system objectives.EventRegulated
System IndicatornounMWESymbol or group of symbols in an off-line encrypted message identifying the specific cryptosystem or key used in the encryption.DataRegulatedCUI
system integritynounMWEThe quality that a system has when it performs its intended function in an unimpaired manner, free from unauthorized manipulation of the system, whether intentional or accidental.Requirement
system integrity checknounMWEA periodic or on-demand security verification process that examines a computing system's files, configurations, software, and runtime state against a known-good trusted baseline to confirm that no unauthorized or undetected alterations have occurred. It detects unauthorized changes — such as those caused by malware, intrusions, or misconfiguration — by comparing current values against known-good reference values, usually cryptographic hashes. Mechanically, this typically involves hashing executables, scripts, libraries, and other critical artifacts and checking them against a stored baseline, so that replacement by a malicious file causes an immediate failure. In practice, it supports incident detection and forensic investigation and demonstrates compliance with frameworks such as PCI DSS, which explicitly requires file integrity monitoring on critical systems.ProcessRegulated
System InterconnectionnounMWEThe direct connection of two or more IT systems for the purpose of sharing data and other information resources.NetworkRegulated
system managementnounMWEThis phrase is compositional rather than a term of art. In the context of the quoted passage — listing duties such as assessments and programming alongside it — "system management" carries its plain administrative meaning: the routine operational oversight and administration of information systems, including configuration, maintenance, and operational control. In the IT field more broadly, systems management refers to enterprise-wide administration of distributed systems including computer systems. While NIST's CSRC glossary does define compound phrases built on "system management" — such as System Management Mode, a high-privilege processor operating mode used for low-level system management functions that is entered only after a System Management Interrupt, and System Management Tools (NISTIR 8219) — none of these is the sense the source document uses; the source passage uses the words in their ordinary, compositional combination as a category of administrative work.Process
system objectivesnounMWEThe entity's objectives, established by entity management, that are embodied in the product commitments it makes to customers, including producing or manufacturing a product that meets product performance specifications and other production, manufacturing, or distribution specifications. The system objectives also include the requirements established for the functioning of the system to meet production, manufacturing, or distribution commitments.Requirement
System of MacrophagesnounMWEa widely distributed system of free and fixed macrophages derived from bone marrowverified
System of MeasurementnounMWEa system of related measures that facilitates the quantification of some particular characteristicverified
System Of RecordsnounMWEA group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.DataRegulatedPII
System of SystemsnounMWEset of systems and system elements that interact to provide a unique capability that none of the constituent systems can accomplish on its own (note: can be necessary to facilitate interaction of the constituent systems in the system of systems)System
System of Weights and MeasuresnounMWEsystem of measurement for length and weight and durationverified
system operationnounMWEThe day to day processes of using a system according to its design and development criteria.Process
System OwnernounMWEPerson or organization having responsibility for the development, procurement, integration, modification, operation and maintenance, and/or final disposition of an information system.Role
system processnounMWEAn active security principal—specifically, an executing software process on a computing system—that has been granted an identity and access rights so it can perform actions on behalf of a human user without that user being directly present. NIST (SP 800-37 Rev. 2) treats it as one of the two forms a "system user" may take: "an individual or (system) process acting on behalf of an individual that is authorized to access information and information systems to perform assigned duties." In access-control frameworks such as NIST SP 800-53 and SP 800-171, system processes are classified alongside human users as **active entities or subjects** that access control policies must govern, standing in contrast to passive objects such as devices, files, records, and domains. Practically, if a user launches an application or background tool, that application runs as the user and "is acting on behalf of the user," meaning any process running under a user's authority must be confined to the same access permissions as that user and no more.ProcessRegulated
System ProfilenounMWEDetailed security description of the physical structure, equipment component, location, relationships, and general operating environment of an information system.ArtifactRegulatedCUI
System ProgramnounMWEa program (as an operating system or compiler or utility program) that controls some aspect of the operation of a computerverified
system requirementsnounMWESpecifications regarding how the system should function to ( a ) meet the entity's commitments to customers and others (such as customers' customers); ( b ) meet the entity's commitments to suppliers and business partners; ( c ) comply with relevant laws and regulations and guidelines of industry groups, such as business or trade associations; and ( d ) achieve other entity objectives that are relevant to the trust services category or categories addressed by the description. Requirements are often specified in the entity's system policies and procedures, system design documentation, contracts with customers, and government regulations.
System requirements may result from the entity's commitments relating to security, availability, processing integrity, confidentiality, or privacy. For example, a commitment to programmatically enforce segregation of duties between data entry and data approval creates system requirements regarding user access administration.RequirementRegulated
System resourcesnounMWECapabilities that can be accessed by a user or program either on the user's machine or across the network. Capabilities can be services, such as file or print services, or devices, such as routers.System
system securitynounMWEThe protection of Bulk Electronic System (BES) Cyber Systems against compromise that could lead to misoperation or instability in the Bulk Electronic System (BES).CapabilityRegulatedCUI
System Security OfficernounMWEA person responsible for enforcement or administration of the security policy that applies to the system.Role
System Security PlannounMWEA document that describes how an organization meets the security requirements for a system or how an organization plans to meet the requirements. In particular, the system security plan describes the system boundary, the environment in which the system operates, how security requirements are implemented, and the relationships with or connections to other systems.ArtifactRegulatedCUI
system servicenounMWEA capability provided by a system that facilitates information processing, storage, or transmission.Capability
System SoftwarenounMWEThe special software within the cryptographic boundary (e.g., operating system, compilers or utility programs) designed for a specific computer system or family of computer systems to facilitate the operation and maintenance of the computer system, associated programs, and data.SystemRegulated
system support functionnounMWEA category of privileged IT activities — such as configuration management, quality assurance and testing, system management, programming, and network security — that must be distributed across multiple individuals or roles rather than concentrated in any one person. It is distinguished from mission or business functions by its technical/administrative character: these are the internal operational tasks that keep a system running and secure, as opposed to the outputs the system produces for the organization. In the field, the concept is invoked as one of the three main mechanisms for implementing separation of duties (NIST SP 800-53 AC-5; NIST SP 800-171 control 3.1.4), alongside dividing mission functions and preventing administrators from holding cross-cutting privileges such as both access-control administration and audit administration.ProcessRestrictedCUI
system upgradenounMWEA planned, authorized lifecycle event in which one or more components of an operational information system — software, firmware, or hardware — are replaced or advanced to a newer version, typically involving a service interruption or maintenance window. It is distinguished from a routine patch or hotfix by its broader scope: a system upgrade commonly replaces a major version, introduces new functionality, or transitions the platform itself, rather than simply remediating a discrete vulnerability. In security and compliance frameworks it appears alongside scheduled maintenance as a category of anticipated downtime that must be governed by change-management controls — including authorization, scheduling, testing, and documented rollback plans — so that the upgrade event does not itself introduce new risk or violate availability commitments. The phrase is compositional (upgrade of a system) rather than a specialized term of art with a fixed regulatory definition, and its meaning is understood directly from its component words across NIST, CMMC, and related authority documents.Process
system usagenounMWEA characterization, established at provisioning time, of the purposes, functions, and scope for which a particular user or role is authorized to interact with an information system. It is distinguished from mere access authorization by its forward-looking, descriptive quality: it captures *what the system is being used for* by a given account holder—mission function, business role, data types handled—not simply *whether* access is permitted. In access-control and account-management practice, access to a system is granted based on a valid access authorization, *intended system usage*, and other attributes required by the organization or associated missions/business functions. Correspondingly, account managers must be notified when *system usage* or need-to-know changes for an individual, making it a live attribute that is re-evaluated throughout the account lifecycle, not just at onboarding.RequirementRegulated
system usernounMWEAn individual or (system) process acting on behalf of an individual that is authorized to access a system.Identity
System-Specific PolicynounMWEA System-specific policy is a policy written for a specific system or device.Requirement
System-Specific Security ControlnounMWEA security control for an information system that has not been designated as a common security control or the portion of a hybrid control that is to be implemented within an information system.Control
Systema LymphaticumnounMWEthe interconnected system of spaces and vessels between body tissues and organs by which lymph circulates throughout the bodyverified
Systema NervosumnounMWEthe sensory and control apparatus consisting of a network of nerve cellsverified
Systema Nervosum CentralenounMWEthe portion of the vertebrate nervous system consisting of the brain and spinal cordverified
Systema Nervosum PeriphericumnounMWEthe section of the nervous system lying outside the brain and spinal cordverified
Systema SkeletalenounMWEthe hard structure (bones and cartilages) that provides a frame for the body of an animalverified
Systema UrogenitalenounMWEthe system that includes all organs involved in reproduction and in the formation and voidance of urineverified
Systematic DesensitisationnounMWEa technique used in behavior therapy to treat phobias and other behavior problems involving anxietyverified
Systematic DesensitizationnounMWEa technique used in behavior therapy to treat phobias and other behavior problems involving anxietyverified
Systematistnouna biologist who specializes in the classification of organisms into groups on the basis of their structure and origin and behaviorverified
Systemic BiasnounMWESystemic biases result from procedures and practices of particular institutions that operate in ways which result in certain social groups being advantaged or favored and others being disadvantaged or devalued. This need not be the result of any conscious prejudice or discrimination but rather of the majority following existing rules or norms.Vulnerability
Systemic CirculationnounMWEcirculation that supplies blood to all the body except to the lungsverified
Systemic Lupus ErythematosusnounMWEan inflammatory disease of connective tissue with variable features including fever and weakness and fatigability and joint pains and skin lesions on the face or neck or armsverified
Systems AnalysisnounMWEanalysis of all aspects of a project along with ways to collect information about the operation of its partsverified
Systems DevelopmennounMWEIn the NICE Workforce Framework, cybersecurity work where a person: Works on the development phases of the systems development lifecycle.Process
Systems Development Life Cycle (SDLC)nounMWEAn approach used to plan, design, develop, test, and implement an application system or a major modification to an application system.Process
Systems ProgramnounMWEa program (as an operating system or compiler or utility program) that controls some aspect of the operation of a computerverified
Systems Requirements PlanningnounMWEIn the NICE Workforce Framework, cybersecurity work where a person: Consults with customers to gather and evaluate functional requirements and translates these requirements into technical solutions; provides guidance to customers about applicability of information systems to meet business needs.Process
Systems Security AnalysisnounMWEIn the NICE Workforce Framework, cybersecurity work where a person: Conducts the integration/testing, operations, and maintenance of systems security.Process
Systems Security ArchitecturenounMWEIn the NICE Workforce Framework, cybersecurity work where a person: Develops system concepts and works on the capabilities phases of the systems development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into system and security designs and processes.Process
Systems SoftwarenounMWEa program such as an operating system, compiler, or utility program that controls some aspect of the operation of a computerverified
Systolenounthe contraction of the chambers of the heart, especially the ventricles, to drive blood into the aorta and pulmonary arteryverified
Systolic PressurenounMWEthe blood pressure (as measured by a sphygmomanometer) during the contraction of the left ventricle of the heartverified
Syzygynounthe straight line configuration of 3 celestial bodies (as the sun and earth and moon) in a gravitational systemverified