organization-defined personnel

** An organization-defined control parameter — specifically a placeholder within a NIST SP 800-53 (and related framework) security or privacy control — that the implementing organization must resolve during the tailoring process by naming the specific individuals, positions, or role titles who will be recipients of, approvers for, or notifiers in a given control action. It is "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." Across the catalog, it appears wherever a control must be directed at *someone* — for example, disseminating a security policy, receiving third-party termination notifications, restricting privileged accounts, or reporting atypical usage — and the standard deliberately leaves the slot open so each organization can fill it with whichever job titles, named roles, or individual positions fit its own structure. DISA's Control Correlation Identifier (CCI) decomposition makes the intent explicit: it defines the obligation as "defines the personnel or roles to be recipients" of a given policy or

Advisory only. A term this product ships is defined by an authority document, not by a search result.