organization-defined security-relevant information

** A parameterized scope of protection within the NIST SP 800-53 access-control framework — specifically, any information within information systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security policies or maintain the isolation of code and data — whose exact membership is left for each organization to specify for its own environment. Canonical examples include access control lists, filtering rules for routers or firewalls, configuration parameters for security services, and cryptographic key management information. In practice the phrase serves as an `[Assignment:]` placeholder in control text — specifically preventing access to that designated set of information except during secure, non-operable system states — requiring the implementing organization to enumerate the specific data items that qualify before the control can be considered satisfied. **VERDICT:** TERM_OF_ART **Sources:** - NIST CSRC Glossary, *security-relevant information*: https://csrc.nist.gov/glossary/term/security_relevant_information (NIST SP 800-53 Rev. 5) - CSF.Tools, *AC-3(5): Secur

Advisory only. A term this product ships is defined by an authority document, not by a search result.