organization-defined security function
163569·updated Sep 1, 2026** A placeholder construct used in control frameworks — most prominently NIST SP 800-53 and NIST SP 800-171 — where a security control statement is intentionally left partially open, requiring each implementing organization to enumerate the specific security-enforcing capabilities (hardware, software, or firmware mechanisms such as account management, access authorization configuration, audit-event settings, and intrusion-detection parameter management) that are subject to the control's requirement. It functions as an *assignment operation*: a control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement. In practice, many NIST controls are not "complete" as published but require "fill in the blanks," and these blanks are called Organization-defined Values or Organization-defined Parameters; "organization-defined security functions" is one such parameter, naming whichever protective capabilities the organization determines fall under least-privilege or access-authorization scope — for example, establishing system accounts and assigning privileges, installing software, configuring access authorizations, configuri
Source
Authorize access to [ Assignment: organization-definedthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time
- assignment operation - Glossary | CSRC
- Security Control Spotlight: Organization-Defined Parameters | IT Dojo
- Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- security functionality - Glossary | CSRC
- AC-6(1): Authorize Access To Security Functions - CSF Tools
- 1 January 18, 2011 SELECT STEP FAQS NIST RISK MANAGEMENT FRAMEWORK
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A parameter-bearing descriptor used in control statements to denote the subset of a system's policy-enforcing hardware, software, and firmware capabilities — formally called "security functions" — that a particular organization has selected, named, or scoped for a given control requirement. It is distinguished from the base term "security functions" by the "organization-defined" qualifier, which is a standard NIST SP 800-53 templating convention signaling that the implementing organization must enumerate the specific functions in its own security plan rather than accepting a universal list. In practice, such functions include account management interfaces, access-authorization configurations, audit-event settings, and intrusion-detection parameters, but the exact set is determined by each organization's system boundaries and risk decisions. The phrase is compositional: its meaning is fully derived from its two established components and it carries no additional sense beyond them.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- organization-defined security functions
- possessive
- organization-defined security function's
- pluralpossessive
- organization-defined security functions'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- ** A placeholder construct used in control frameworks — most prominently NIST SP 800-53 and NIST SP 800-171 — where a security control statement is intentionally left partially open, requiring each implementing organization to enumerate the specific security-enforcing capabilities (hardware, software, or firmware mechanisms such as account management, access authorization configuration, audit-event settings, and intrusion-detection parameter management) that are subject to the control's requirement. It functions as an *assignment operation*: a control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement. In practice, many NIST controls are not "complete" as published but require "fill in the blanks," and these blanks are called Organization-defined Values or Organization-defined Parameters; "organization-defined security functions" is one such parameter, naming whichever protective capabilities the organization determines fall under least-privilege or access-authorization scope — for example, establishing system accounts and assigning privileges, installing software, configuring access authorizations, configuriDR-088 backfill from the noun definition column