organization-defined device
163629·updated Oct 3, 2026A placeholder value in a security or privacy control statement — specifically an **assignment operation** — that an implementing organization fills in during tailoring to name the exact endpoints, hardware types, or classes of endpoint (workstations, servers, mobile devices, IoT sensors, personally-owned BYOD assets, etc.) to which the control applies. It is the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by assigning an organization-defined value or selecting a value from a predefined list. The expression's force is not "a device of a particular kind" but rather "whichever devices or device types the organization has formally decided belong inside the scope of this requirement": devices requiring identification and authentication are defined by type, device, or a combination, and the category explicitly includes devices not owned by the organization. In practice it gives organizations the latitude described by NIST SP 800-53: organizations can restrict the application of the control to a limited number or type of devices based on mission or business needs, while still committing to a specific, auditable scope once the parameter is set. Once specified, the values for the assignment and selection statements become a permanent part of the control.
Source
Uniquely identify and authenticate [ Assignment: organization-defined devices or types of devices ] before establishing a system connection.the sentence this term was read in
generalized from a web lookup of the quoted expression, with 1 reviewed place(s) it is used as the term Verdict: compositional.
- organization-defined parameter - Glossary
- SL5 Standard for AI Security
- Draft NIST Special Publication 800-53 Revision 5
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A placeholder value in a security or privacy control statement — specifically an **assignment operation** — that an implementing organization fills in during tailoring to name the exact endpoints, hardware types, or classes of endpoint (workstations, servers, mobile devices, IoT sensors, personally-owned BYOD assets, etc.) to which the control applies. It is the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by assigning an organization-defined value or selecting a value from a predefined list. The expression's force is not "a device of a particular kind" but rather "whichever devices or device types the organization has formally decided belong inside the scope of this requirement": devices requiring identification and authentication are defined by type, device, or a combination, and the category explicitly includes devices not owned by the organization. In practice it gives organizations the latitude described by NIST SP 800-53: organizations can restrict the application of the control to a limited number or type of devices based on mission or business needs, while still committing to a specific, auditable scope once the parameter is set. Once specified, the values for the assignment and selection statements become a permanent part of the control.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- organization-defined devices
- possessive
- organization-defined device's
- pluralpossessive
- organization-defined devices'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A placeholder value in a security or privacy control statement — specifically an **assignment operation** — that an implementing organization fills in during tailoring to name the exact endpoints, hardware types, or classes of endpoint (workstations, servers, mobile devices, IoT sensors, personally-owned BYOD assets, etc.) to which the control applies. It is the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by assigning an organization-defined value or selecting a value from a predefined list. The expression's force is not "a device of a particular kind" but rather "whichever devices or device types the organization has formally decided belong inside the scope of this requirement": devices requiring identification and authentication are defined by type, device, or a combination, and the category explicitly includes devices not owned by the organization. In practice it gives organizations the latitude described by NIST SP 800-53: organizations can restrict the application of the control to a limited number or type of devices based on mission or business needs, while still committing to a specific, auditable scope once the parameter is set. Once specified, the values for the assignment and selection statements become a permanent part of the control.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.