1. A statement of intent to counter specified threats and/or satisfy specified organizational security policies or assumptions.
2. The contribution to security which a Target of Evaluation is intended to achieve[ITSEC].

Documentation specifying the procedures that are to be carried out by system users (including the System Administrator and operators) to uphold all aspects of security devolved to the System Manager by the Departmental Security officer in the System Security Policy. Also abbreviated to SECOPS and SOPs [CESG]. See also: System Security Officer.

All components/devices of an information system (IS) to be accredited. Separately accredited components generally are not included within the perimeter. [INFOSEC-99]

1. The overall principles, regulations, requirements, and/or procedures which govern security as expressed by a responsible security authority: Examples: National security policy, Departmental security policy.
Note: Responsibility for security may be delegated by Departmental Security Officers to System Managers in accordance with a System Security Policy [CESG].
2. A set of rules that specify the procedures and mechanisms required to… (Read More →)

1. An informal presentation of a formal security policy model [POSIX.6].
2. An informal presentation of a formal security policy model [TCSEC].
3. A logically precise distillation of all or part of a System Electronic Information Security Policy, developed to avoid ambiguities and inconsistencies and to form a sound basis for subsequent stages of the development of a system [CESG].… (Read More →)

[The] highest and lowest security levels that are permitted in or on an information system (IS), system component, subsystem, or network. [INFOSEC-99]

That which is not security enforcing, but must function correctly for the Target of Evaluation to enforce security [ITSEC].

Any event that attempts to change the security state of the system, (e.g., change discretionary access controls, change the security level of the subject, change user password, etc. ). Also, any event that attempts to violate the security policy of the system, (e.g., too many attempts to login, attempts to violate the mandatory access control limits of a device, attempts… (Read More →)

The statement by the Departmental Security Officer (DSO) of the minimum standards to be met by a specific system and particular threats which are to be countered [CESG].
Note: A Security requirement should be stated in response to an Initial System Security Policy and should then be incorporated in the System Security policy. It should include a statement of the… (Read More →)

Protective measures and controls prescribed to meet the security requirements specified for an information system (IS). Safeguards may include security features, management constraints, personnel security, and security of physical structures, areas, and devices. [INFOSEC-99]