critical application
163685·updated Oct 5, 2026An application classification assigned through impact analysis to any software system whose loss of availability, loss of integrity, or unauthorized access would materially impair an organization's mission, revenue, regulatory standing, or public safety obligations. It is distinguished from ordinary applications by the severity and breadth of harm its failure produces — not by its technical architecture — and the classification is operationalized by mandating a proportionately higher tier of security controls: stronger access governance, elevated monitoring priority, stricter change approval, and dedicated incident-response treatment. In federal and compliance frameworks, the category maps directly to what OMB Circular A-130 and NIST SP 800-18 call a "major application," meaning one that "requires special attention to security due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application," because "certain applications, because of the information in them, require special management oversight and should be treated as major."
Source
A system monitoring capability is achieved through a variety of tools and techniques (e.g., audit record monitoring software, intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms that support critical applications with such devices being employed at managed system interfaces. The granularity of monitoring the information collected is based on organizational monitoring objectives and the capability of the system to support such objectives.the sentence this term was read in
generalized from a web lookup of the quoted expression, with 1 reviewed place(s) it is used as the term Verdict: term of art.
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
An application classification assigned through impact analysis to any software system whose loss of availability, loss of integrity, or unauthorized access would materially impair an organization's mission, revenue, regulatory standing, or public safety obligations. It is distinguished from ordinary applications by the severity and breadth of harm its failure produces — not by its technical architecture — and the classification is operationalized by mandating a proportionately higher tier of security controls: stronger access governance, elevated monitoring priority, stricter change approval, and dedicated incident-response treatment. In federal and compliance frameworks, the category maps directly to what OMB Circular A-130 and NIST SP 800-18 call a "major application," meaning one that "requires special attention to security due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application," because "certain applications, because of the information in them, require special management oversight and should be treated as major."
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- critical applications
- possessive
- critical application's
- pluralpossessive
- critical applications'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An application classification assigned through impact analysis to any software system whose loss of availability, loss of integrity, or unauthorized access would materially impair an organization's mission, revenue, regulatory standing, or public safety obligations. It is distinguished from ordinary applications by the severity and breadth of harm its failure produces — not by its technical architecture — and the classification is operationalized by mandating a proportionately higher tier of security controls: stronger access governance, elevated monitoring priority, stricter change approval, and dedicated incident-response treatment. In federal and compliance frameworks, the category maps directly to what OMB Circular A-130 and NIST SP 800-18 call a "major application," meaning one that "requires special attention to security due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application," because "certain applications, because of the information in them, require special management oversight and should be treated as major."Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.