organization-defined security-relevant information

A tailorable control parameter — an open slot in a security or privacy control statement — that an implementing organization fills in at the time of control tailoring by enumerating the specific subset of system information whose sensitivity to security-function integrity warrants protection under that control. The parent concept, *security-relevant information*, is defined by NIST as "information within the system that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data." Canonical examples include access control lists, filtering rules for routers or firewalls, configuration parameters for security services, and cryptographic key management information. In practice the full expression appears as an *Assignment* parameter inside a control statement — specifically, NIST SP 800-53 control AC-3(5) reads: "Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states" — meaning each organization must supply its own enumerated list of which security-relevant data assets that control governs, rather than accepting a single universal list; an organization-defined control parameter is formally "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list provided as part of the control or control enhancement."

Advisory only. A term this product ships is defined by an authority document, not by a search result.