Glossary

Term	Meaning
3PAO	Third-party assessment organization accredited to assess FedRAMP cloud services
AO	Authorizing Official: senior official who accepts system risk and signs the decision
AODR	AO designated representative: acts for the AO but cannot sign or accept risk
ATO	Authorization to operate
ATU	Authorization to use another organization’s authorized system or service
Authorization boundary	Everything the AO’s decision covers: components under the same management and mission
cATO	Continuous authorization to operate: DoD approach relying on real-time monitoring of a DevSecOps pipeline
CCP	Common control provider: owns controls other systems inherit
CDM	Continuous Diagnostics and Mitigation: CISA program supplying monitoring tools and dashboards
Common, hybrid, system-specific control	Fully inherited; shared between provider and system; fully the system’s own
CUI	Controlled Unclassified Information
eMASS	Enterprise Mission Assurance Support Service: DoD’s RMF workflow tool
High-water mark	Using the highest impact level across C, I and A as the system’s overall level
IATT	Interim authority to test (DoD)
ISCM or ConMon	Information security continuous monitoring
ISSM, ISSO	Information system security manager; information system security officer
ODP	Organization-defined parameter: a value the organization fills in inside a control
OSCAL	Open Security Controls Assessment Language: NIST’s machine-readable format for catalogs, plans and assessments
Overlay	A set of control additions or removals for a specific context or community
PIA, PTA, SORN	Privacy impact assessment; privacy threshold analysis; system of records notice
POA&M	Plan of action and milestones for open weaknesses
SAISO, SAOP	Senior agency information security officer; senior agency official for privacy
SAP, SAR	Security assessment plan; security assessment report
SCA	Security control assessor
Significant change	A change likely to substantially affect the system’s security or privacy posture; triggers reassessment
SSP	System security plan (with the privacy plan, the “security and privacy plans”)
STIG	Security Technical Implementation Guide published by DISA
Tailoring	Adjusting a baseline: scoping, compensating controls, parameter values, additions