organization-defined time period
163500·updated Aug 30, 2026A placeholder variable embedded within a security or privacy control statement—a species of **organization-defined parameter (ODP)**—that reserves a duration value for the implementing organization to specify during the tailoring process. It is "the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a predefined list provided as part of the control or control enhancement." In practice, the standards body intentionally leaves the duration blank because the correct threshold differs by context, risk tolerance, and applicable regulatory constraints; organization-defined parameters are used in NIST SP 800-53 controls "to provide flexibility to federal agencies in tailoring controls to support specific organizational missions or business functions and to manage risk." Once filled in, the chosen value becomes part of the enforceable requirement and is subject to assessment: once ODPs have been defined, they become part of the security requirement and can be assessed as such, and they help simplify assessments by providing greater specificity and
Source
The accounts have been inactive for [ Assignment: organization-defined time period ],the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- organization defined control parameter
- Security Control Spotlight: Organization-Defined Parameters | IT Dojo
- AC: Access Control - CSF Tools
- Organization-Defined Parameters for National Institute of ...
- NIST Special Publication 800-53 Revision 1 Excerpt
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A **time-typed organization-defined parameter (ODP)** — a placeholder embedded in a security or privacy control statement that a deploying organization must replace with a concrete duration or interval during the control-tailoring process. Per the NIST Computer Security Resource Center glossary (sourced from NIST SP 800-37 Rev. 2 and SP 800-53 Rev. 5), an organization-defined control parameter is "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." "Organization-defined time period" is the time-dimensioned instance of that class of parameter: many NIST controls are not "complete" as published but require "fill in the blanks," and those blanks are called Organization-Defined Values or Organization-Defined Parameters. In practice it appears across a wide range of control families — account management, audit retention, identifier reuse, lockout windows, and more — wherever the standard mandates a time-bounded obligation but deliberately leaves the specific duration to organizational risk and policy judgment: for example, enforcing a limit on consecutive invalid logon attempts "during a [Assignment: organization-defined time period]" and then locking the account "for [Assignment: organization-defined time period]"; preventing "the reuse of identifiers for [Assignment: organization-defined time period]"; and disabling a user identifier "after [Assignment: organization-defined time period] of inactivity."
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- organization-defined time periods
- possessive
- organization-defined time period's
- pluralpossessive
- organization-defined time periods'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 16 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A placeholder variable embedded within a security or privacy control statement—a species of **organization-defined parameter (ODP)**—that reserves a duration value for the implementing organization to specify during the tailoring process. It is "the variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a predefined list provided as part of the control or control enhancement." In practice, the standards body intentionally leaves the duration blank because the correct threshold differs by context, risk tolerance, and applicable regulatory constraints; organization-defined parameters are used in NIST SP 800-53 controls "to provide flexibility to federal agencies in tailoring controls to support specific organizational missions or business functions and to manage risk." Once filled in, the chosen value becomes part of the enforceable requirement and is subject to assessment: once ODPs have been defined, they become part of the security requirement and can be assessed as such, and they help simplify assessments by providing greater specificity andDR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A **time-typed organization-defined parameter (ODP)** — a placeholder embedded in a security or privacy control statement that a deploying organization must replace with a concrete duration or interval during the control-tailoring process. Per the NIST Computer Security Resource Center glossary (sourced from NIST SP 800-37 Rev. 2 and SP 800-53 Rev. 5), an organization-defined control parameter is "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." "Organization-defined time period" is the time-dimensioned instance of that class of parameter: many NIST controls are not "complete" as published but require "fill in the blanks," and those blanks are called Organization-Defined Values or Organization-Defined Parameters. In practice it appears across a wide range of control families — account management, audit retention, identifier reuse, lockout windows, and more — wherever the standard mandates a time-bounded obligation but deliberately leaves the specific duration to organizational risk and policy judgment: for example, enforcing a limit on consecutive invalid logon attempts "during a [Assignment: organization-defined time period]" and then locking the account "for [Assignment: organization-defined time period]"; preventing "the reuse of identifiers for [Assignment: organization-defined time period]"; and disabling a user identifier "after [Assignment: organization-defined time period] of inactivity."Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.