- availability
means ensuring timely and reliable access to and use of information.
- confidentiality
means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information.
- consumer report
has the meaning provided such term in subsection (d) of section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a(d)).
- consumer reporting agency
means—
- control techniques
means methods for guiding and controlling the operations of information systems to ensure adherence to the provisions of subchapter III of chapter 35 of title 44 and other related information security requirements.
- data breach
means the loss, theft, or other unauthorized access, other than those incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data.
- data breach analysis
means the process used to determine if a data breach has resulted in the misuse of sensitive personal information.
- fraud resolution services
means services to assist an individual in the process of recovering and rehabilitating the credit of the individual after the individual experiences identity theft.
- identity theft
has the meaning given such term under section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a).
- identity theft insurance
means any insurance policy that pays benefits for costs, including travel costs, notary fees, and postage costs, lost wages, and legal fees and expenses associated with efforts to correct and ameliorate the effects and results of identity theft of the insured individual.
- information owner
means an agency official with statutory or operational authority for specified information and responsibility for establishing the criteria for its creation, collection, processing, dissemination, or disposal, which responsibilities may extend to interconnected systems or groups of interconnected systems.
- information resources
means information in any medium or form and its related resources, such as personnel, equipment, funds, and information technology.
- information security
means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality, and availability.
- information security requirements
means information security requirements promulgated in accordance with law, or directed by the Secretary of Commerce, the National Institute of Standards and Technology, and the Office of Management and Budget, and, as to national security systems, the President.
- information system
means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information, whether automated or manual.
- integrity
means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.
- medical quality-assurance program
means—
- national security system
means an information system that is protected at all times by policies and procedures established for the processing, maintenance, use, sharing, dissemination or disposition of information that has been specifically authorized under criteria established by statute or Executive Order to be kept classified in the interest of national defense or foreign policy.
- organ procurement organization
has the meaning given the term “qualified organ procurement organization” in section 371(b) of the Public Health Service Act (42 U.S.C. 273(b)).
- principal credit reporting agency
means a consumer reporting agency as described in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)).
- security incident
means an event that has, or could have, resulted in loss or damage to Department assets, or sensitive information, or an action that breaches Department security procedures.
- training
means a learning experience in which an individual is taught to execute a specific information security procedure or understand the information security common body of knowledge.