organization-defined time period

A **time-typed organization-defined parameter (ODP)** — a placeholder embedded in a security or privacy control statement that a deploying organization must replace with a concrete duration or interval during the control-tailoring process. Per the NIST Computer Security Resource Center glossary (sourced from NIST SP 800-37 Rev. 2 and SP 800-53 Rev. 5), an organization-defined control parameter is "the variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list." "Organization-defined time period" is the time-dimensioned instance of that class of parameter: many NIST controls are not "complete" as published but require "fill in the blanks," and those blanks are called Organization-Defined Values or Organization-Defined Parameters. In practice it appears across a wide range of control families — account management, audit retention, identifier reuse, lockout windows, and more — wherever the standard mandates a time-bounded obligation but deliberately leaves the specific duration to organizational risk and policy judgment: for example, enforcing a limit on consecutive invalid logon attempts "during a [Assignment: organization-defined time period]" and then locking the account "for [Assignment: organization-defined time period]"; preventing "the reuse of identifiers for [Assignment: organization-defined time period]"; and disabling a user identifier "after [Assignment: organization-defined time period] of inactivity."

Advisory only. A term this product ships is defined by an authority document, not by a search result.