1 line
No EOL
178 KiB
Text
1 line
No EOL
178 KiB
Text
<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="image" href="/_next/static/media/CyberGeek-logo.8e9bbd2b.svg" fetchPriority="high"/><link rel="stylesheet" href="/_next/static/css/ef46db3751d8e999.css" data-precedence="next"/><link rel="stylesheet" href="/_next/static/css/0759e90f4fecfde7.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-182b67d00f496f9d.js"/><script src="/_next/static/chunks/fd9d1056-ad09c71b7719f2fb.js" async=""></script><script src="/_next/static/chunks/23-260042deb5df7a88.js" async=""></script><script src="/_next/static/chunks/main-app-6de3c3100b91a0a9.js" async=""></script><script src="/_next/static/chunks/30-49b1c1429d73281d.js" async=""></script><script src="/_next/static/chunks/317-0f87feacc1712b2f.js" async=""></script><script src="/_next/static/chunks/223-bc9ed43510898bbb.js" async=""></script><script src="/_next/static/chunks/app/layout-9fc24027bc047aa2.js" async=""></script><script src="/_next/static/chunks/972-6e520d137ef194fb.js" async=""></script><script src="/_next/static/chunks/app/page-cc829e051925e906.js" async=""></script><script src="/_next/static/chunks/app/template-d264bab5e3061841.js" async=""></script><script src="/_next/static/chunks/e37a0b60-b74be3d42787b18d.js" async=""></script><script src="/_next/static/chunks/904-dbddf7494c3e6975.js" async=""></script><script src="/_next/static/chunks/549-c87c1c3bbacc319f.js" async=""></script><script src="/_next/static/chunks/app/learn/%5Bslug%5D/page-5b91cdc45a95ebbe.js" async=""></script><link rel="preload" href="/assets/javascript/uswds-init.min.js" as="script"/><link rel="preload" href="/assets/javascript/uswds.min.js" as="script"/><title>Acronyms | CMS Information Security & Privacy Group</title><meta name="description" content="Common security and privacy acronyms used at CMS"/><link rel="canonical" href="https://security.cms.gov/learn/acronyms"/><meta name="google-site-verification" content="GMZIwBDJgz_o_JYUB2GpJazkrs7P85BaWDsoCjxF32M"/><meta property="og:title" content="Acronyms | CMS Information Security & Privacy Group"/><meta property="og:description" content="Common security and privacy acronyms used at CMS"/><meta property="og:url" content="https://security.cms.gov/learn/acronyms"/><meta property="og:image:type" content="image/jpeg"/><meta property="og:image:width" content="1200"/><meta property="og:image:height" content="630"/><meta property="og:image" content="https://security.cms.gov/learn/acronyms/opengraph-image.jpg?d21225707c5ed280"/><meta property="og:type" content="website"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:title" content="Acronyms | CMS Information Security & Privacy Group"/><meta name="twitter:description" content="Common security and privacy acronyms used at CMS"/><meta name="twitter:image:type" content="image/jpeg"/><meta name="twitter:image:width" content="1200"/><meta name="twitter:image:height" content="630"/><meta name="twitter:image" content="https://security.cms.gov/learn/acronyms/opengraph-image.jpg?d21225707c5ed280"/><link rel="icon" href="/favicon.ico" type="image/x-icon" sizes="48x48"/><script>(self.__next_s=self.__next_s||[]).push(["/assets/javascript/uswds-init.min.js",{}])</script><script src="/_next/static/chunks/polyfills-78c92fac7aa8fdd8.js" noModule=""></script></head><body><a class="usa-skipnav" href="#main">Skip to main content</a><section class="usa-banner" aria-label="Official website of the United States government"><div class="usa-accordion"><header class="usa-banner__header"><div class="usa-banner__inner"><div class="grid-col-auto"><img aria-hidden="true" alt="" loading="lazy" width="16" height="11" decoding="async" data-nimg="1" class="usa-banner__header-flag" style="color:transparent" srcSet="/_next/image?url=%2Fassets%2Fimg%2Fus_flag_small.png&w=16&q=75 1x, /_next/image?url=%2Fassets%2Fimg%2Fus_flag_small.png&w=32&q=75 2x" src="/_next/image?url=%2Fassets%2Fimg%2Fus_flag_small.png&w=32&q=75"/></div><div class="grid-col-fill tablet:grid-col-auto" aria-hidden="true"><p class="usa-banner__header-text">An official website of the United States government</p><p class="usa-banner__header-action">Here's how you know</p></div><button type="button" class="usa-accordion__button usa-banner__button" aria-expanded="false" aria-controls="gov-banner-default-default"><span class="usa-banner__button-text">Here's how you know</span></button></div></header><div class="usa-banner__content usa-accordion__content" id="gov-banner-default-default" hidden=""><div class="grid-row grid-gap-lg"><div class="usa-banner__guidance tablet:grid-col-6"><img role="img" alt="" aria-hidden="true" loading="lazy" width="40" height="40" decoding="async" data-nimg="1" class="usa-banner__icon usa-media-block__img" style="color:transparent" src="/_next/static/media/icon-dot-gov.3e9cb1b5.svg"/><div class="usa-media-block__body"><p><strong>Official websites use .gov</strong><br/>A <strong>.gov</strong> website belongs to an official government organization in the United States.</p></div></div><div class="usa-banner__guidance tablet:grid-col-6"><img role="img" alt="" aria-hidden="true" loading="lazy" width="40" height="40" decoding="async" data-nimg="1" class="usa-banner__icon usa-media-block__img" style="color:transparent" src="/_next/static/media/icon-https.e7f1a222.svg"/><div class="usa-media-block__body"><p><strong>Secure .gov websites use HTTPS</strong><br/>A <strong>lock</strong> (<span class="icon-lock"><svg xmlns="http://www.w3.org/2000/svg" width="52" height="64" viewBox="0 0 52 64" class="usa-banner__lock-image" role="img" aria-labelledby="banner-lock-description-default" focusable="false"><title id="banner-lock-title-default">Lock</title><desc id="banner-lock-description-default">Locked padlock icon</desc><path fill="#000000" fill-rule="evenodd" d="M26 0c10.493 0 19 8.507 19 19v9h3a4 4 0 0 1 4 4v28a4 4 0 0 1-4 4H4a4 4 0 0 1-4-4V32a4 4 0 0 1 4-4h3v-9C7 8.507 15.507 0 26 0zm0 8c-5.979 0-10.843 4.77-10.996 10.712L15 19v9h22v-9c0-6.075-4.925-11-11-11z"></path></svg></span>) or <strong>https://</strong> means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.</p></div></div></div></div></div></section><div class="usa-overlay"></div><header class="usa-header usa-header--extended"><div class="bg-primary-dark"><div class="usa-navbar"><div class="usa-logo padding-y-4 padding-right-3" id="CyberGeek-logo"><a title="CMS CyberGeek Home" href="/"><img alt="CyberGeek logo" fetchPriority="high" width="298" height="35" decoding="async" data-nimg="1" style="color:transparent" src="/_next/static/media/CyberGeek-logo.8e9bbd2b.svg"/></a></div><button aria-label="Open menu" type="button" class="usa-menu-btn" data-cy="menu-button">Menu</button></div></div><nav aria-label="Primary navigation" class="usa-nav padding-0 desktop:width-auto bg-white grid-container float-none"><div class="usa-nav__inner"><button type="button" class="usa-nav__close margin-0"><img alt="Close" loading="lazy" width="24" height="24" decoding="async" data-nimg="1" style="color:transparent" src="/_next/static/media/close.1fafc2aa.svg"/></button><ul class="usa-nav__primary usa-accordion"><li class="usa-nav__primary-item"><button type="button" class="usa-accordion__button usa-nav__link font-family-serif text-medium tablet:text-no-wrap desktop:text-primary-vivid" aria-expanded="false" aria-controls="roles"><span>Roles</span></button><ul id="roles" class="usa-nav__submenu usa-megamenu bg-white" hidden=""><li class="grid-row grid-gap-3 padding-bottom-6"><div class="usa-col text-center desktop:text-right text-normal position-relative nav-label"><span class="display-block font-heading-xl padding-top-2">Roles</span></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/information-system-security-officer-isso">Information System Security Officer (ISSO)</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/cms-information-system-security-officer-isso-handbook"><span>ISSO Handbook</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/cms-information-system-security-officer-isso-handbook#getting-started-for-new-issos"><span>Getting started (for new ISSOs)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/isso-mentorship-program"><span>ISSO Mentorship Program</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/cms-information-system-security-officer-isso-handbook#training"><span>ISSO Training</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/data-guardian">Data Guardian</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/data-guardian-handbook"><span>Data Guardian Handbook</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/cyber-risk-advisor-cra">Cyber Risk Advisor (CRA)</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-security-and-privacy-handbooks"><span>CMS Security and Privacy Handbooks</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-security-and-privacy-handbooks#risk-management-handbook-rmh-chapters"><span>Risk Management Handbook (RMH)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/business-system-owner">Business / System Owner (BO/SO)</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cybersecurity-risk-assessment-program-csrap"><span>Cybersecurity and Risk Assessment Program (CSRAP)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-information-exchange-agreement-iea"><span>Information Exchange Agreement (IEA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-computer-matching-agreement-cma"><span>Computer Matching Agreement (CMA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/isso-service"><span>ISSO As A Service</span></a></li></ul></section></div></li></ul></li><li class="usa-nav__primary-item"><button type="button" class="usa-accordion__button usa-nav__link font-family-serif text-medium tablet:text-no-wrap desktop:text-primary-vivid" aria-expanded="false" aria-controls="compliance-authorization"><span>Compliance & Authorization</span></button><ul id="compliance-authorization" class="usa-nav__submenu usa-megamenu bg-white" hidden=""><li class="grid-row grid-gap-3 padding-bottom-6"><div class="usa-col text-center desktop:text-right text-normal position-relative nav-label"><span class="display-block font-heading-xl padding-top-2">Compliance & Authorization</span></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/learn/authorization-operate-ato">Authorization to Operate (ATO)</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/authorization-operate-ato"><span>About ATO at CMS</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/authorization-operate-ato#types-of-authorizations"><span>Types of authorizations</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/authorization-operate-ato#ato-stakeholders"><span>ATO stakeholders</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/authorization-operate-ato#related-documents-and-resources"><span>ATO tools and resources</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-technical-reference-architecture-tra"><span>CMS Technical Reference Architecture (TRA)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/learn/ongoing-authorization-oa">Ongoing Authorization (OA)</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/ongoing-authorization-oa"><span>About OA at CMS</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/ongoing-authorization-oa#is-my-system-eligible-for-oa"><span>OA eligibility requirements</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/continuous-diagnostics-and-mitigation-cdm"><span>Continuous Diagnostics and Mitigation (CDM)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header list-header-margin">Assessments & Audits</h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/penetration-testing-pentesting"><span>Penetration Testing</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cybersecurity-risk-assessment-program-csrap"><span>Cybersecurity Risk Assessment Program (CSRAP)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/privacy-impact-assessment-pia"><span>Privacy Impact Assessment (PIA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/security-impact-analysis-sia"><span>Security Impact Analysis (SIA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/system-audits"><span>System Audits</span></a></li></ul></section></div></li></ul></li><li class="usa-nav__primary-item"><button type="button" class="usa-accordion__button usa-nav__link font-family-serif text-medium tablet:text-no-wrap desktop:text-primary-vivid" aria-expanded="false" aria-controls="policy-guidance"><span>Policy & Guidance</span></button><ul id="policy-guidance" class="usa-nav__submenu usa-megamenu bg-white" hidden=""><li class="grid-row grid-gap-3 padding-bottom-6"><div class="usa-col text-center desktop:text-right text-normal position-relative nav-label"><span class="display-block font-heading-xl padding-top-2">Policy & Guidance</span></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/cms-policies-and-guidance">CMS Policies and Guidance</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/cms-acceptable-risk-safeguards-ars"><span>CMS Acceptable Risk Safeguards (ARS)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/cms-information-systems-security-privacy-policy-is2p2"><span>CMS Information Security and Privacy Policy (IS2P2)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-security-and-privacy-handbooks"><span>CMS Security and Privacy Handbooks</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="https://security.cms.gov/learn/cms-risk-management-framework-rmf"><span>CMS Risk Management Framework (RMF)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/email-encryption-requirements-cms"><span>CMS Email Encryption</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/federal-policies-and-guidance">Federal Policies and Guidance</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/national-institute-standards-and-technology-nist"><span>National Institute of Standards and Technology (NIST)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/federal-information-security-modernization-act-fisma"><span>Federal Information Security Modernization Act (FISMA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/fedramp"><span>Federal Risk and Authorization Management Program (FedRAMP)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/zero-trust"><span>Zero Trust</span></a></li></ul></section></div></li></ul></li><li class="usa-nav__primary-item"><button type="button" class="usa-accordion__button usa-nav__link font-family-serif text-medium tablet:text-no-wrap desktop:text-primary-vivid" aria-expanded="false" aria-controls="system-security"><span>System Security</span></button><ul id="system-security" class="usa-nav__submenu usa-megamenu bg-white" hidden=""><li class="grid-row grid-gap-3 padding-bottom-6"><div class="usa-col text-center desktop:text-right text-normal position-relative nav-label"><span class="display-block font-heading-xl padding-top-2">System Security</span></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/application-security">Application Security</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/threat-modeling"><span>Threat Modeling</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/zero-trust"><span>Zero Trust</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-cloud-services"><span>CMS Cloud Services</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/software-bill-materials-sbom"><span>Software Bill of Materials (SBOM)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/security-operations">Security Operations</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/risk-management-handbook-chapter-8-incident-response-ir"><span>Incident Response</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-cybersecurity-integration-center-ccic"><span>CMS Cybersecurity Integration Center (CCIC)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/penetration-testing-pentesting"><span>Penetration Testing</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header"><a href="/ispg/risk-management-and-reporting">Risk Management and Reporting</a></h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/continuous-diagnostics-and-mitigation-cdm"><span>Continuous Diagnostics and Mitigation (CDM)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cyber-risk-reports"><span>Cyber Risk Reports</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/plan-action-and-milestones-poam"><span>Plan of Action and Milestones (POA&M)</span></a></li></ul></section></div></li></ul></li><li class="usa-nav__primary-item"><button type="button" class="usa-accordion__button usa-nav__link font-family-serif text-medium tablet:text-no-wrap desktop:text-primary-vivid" aria-expanded="false" aria-controls="privacy"><span>Privacy</span></button><ul id="privacy" class="usa-nav__submenu usa-megamenu bg-white" hidden=""><li class="grid-row grid-gap-3 padding-bottom-6"><div class="usa-col text-center desktop:text-right text-normal position-relative nav-label"><span class="display-block font-heading-xl padding-top-2">Privacy</span></div><div class="usa-col"><section><h3 class="usa-col__list-header list-header-margin">Agreements</h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-computer-matching-agreement-cma"><span>Computer Matching Agreement (CMA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-information-exchange-agreement-iea"><span>Information Exchange Agreement (IEA)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header list-header-margin">Privacy Activities</h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/breach-response"><span>Breach Response</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/privacy-impact-assessment-pia"><span>Privacy Impact Assessment (PIA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/system-records-notice-sorn"><span>System of Records Notice (SORN)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header list-header-margin">Privacy Resources</h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/ispg/privacy"><span>Privacy at CMS</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/cms-breach-response-handbook"><span>CMS Breach Response Handbook</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/health-insurance-portability-and-accountability-act-1996-hipaa"><span>Health Insurance Portability and Accessibility Act (HIPAA)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/policy-guidance/cms-privacy-impact-assessment-pia-handbook"><span>CMS Privacy Impact Assessment (PIA) Handbook</span></a></li></ul></section></div></li></ul></li><li class="usa-nav__primary-item"><button type="button" class="usa-accordion__button usa-nav__link font-family-serif text-medium tablet:text-no-wrap desktop:text-primary-vivid" aria-expanded="false" aria-controls="tools-services"><span>Tools & Services</span></button><ul id="tools-services" class="usa-nav__submenu usa-megamenu bg-white" hidden=""><li class="grid-row grid-gap-3 padding-bottom-6"><div class="usa-col text-center desktop:text-right text-normal position-relative nav-label"><span class="display-block font-heading-xl padding-top-2">Tools & Services</span></div><div class="usa-col"><section><h3 class="usa-col__list-header list-header-margin">Reporting & Compliance</h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="https://security.cms.gov/learn/isso-service"><span>ISSO As A Service</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-fisma-continuous-tracking-system-cfacts"><span>CFACTS</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cyber-risk-reports"><span>Cyber Risk Reports and Dashboards</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/continuous-diagnostics-and-mitigation-cdm"><span>Continuous Diagnostics and Mitigation (CDM)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header list-header-margin">System Security</h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/threat-modeling"><span>Threat Modeling</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-cloud-services"><span>CMS Cloud Services</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cms-cybersecurity-integration-center-ccic"><span>CMS Cybersecurity Integration Center (CCIC)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="https://security.cms.gov/learn/cms-security-data-lake-sdl"><span>CMS Security Data Lake (SDL)</span></a></li></ul></section></div><div class="usa-col"><section><h3 class="usa-col__list-header list-header-margin">Tests & Assessments</h3><ul class="usa-nav__submenu-list"><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/cybersecurity-risk-assessment-program-csrap"><span>Cybersecurity Risk Assessment Program (CSRAP)</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/penetration-testing-pentesting"><span>Penetration Testing</span></a></li><li class="usa-nav__submenu-item font-sans-2xs"><a class="padding-x-0" href="/learn/privacy-impact-assessment-pia"><span>Privacy Impact Assessment (PIA)</span></a></li></ul></section></div></li></ul></li></ul><div class="usa-nav__secondary padding-left-2"><section aria-label="Header search box"><form class="usa-search usa-search--small" role="search" action="/search"><label class="usa-sr-only" for="header-search-box">Search</label><input class="usa-input search__input" id="header-search-box" type="search" name="ispg[query]"/><button aria-label="header search box button" class="usa-button" id="header-search-box-btn" type="submit"><svg aria-describedby="searchIcon" class="usa-icon" aria-hidden="true" focusable="false" role="img"><title id="searchIcon">Search</title><use href="/assets/img/sprite.svg#search"></use></svg></button></form></section></div></div></nav></header><main id="main"><div id="template"><!--$--><!--/$--><section class="hero hero--theme-explainer undefined"><div class="maxw-widescreen margin-x-auto padding-x-2 desktop:padding-x-0 padding-top-4 padding-bottom-6 desktop:padding-y-7"><div class="tablet:grid-container position-relative "><div class="hero__row grid-row grid-gap"><div class="tablet:grid-col-5 widescreen:position-relative"></div><div class="hero__column tablet:grid-col-7 flow padding-bottom-2"><h1 class="hero__heading margin-0 line-height-sans-3 desktop:line-height-sans-2">Acronyms</h1><p class="hero__description">Common security and privacy acronyms used at CMS</p><div class="hero__meta radius-lg padding-x-2 padding-y-1 bg-white font-sans-2xs line-height-sans-5 display-inline-block text-primary-darker">Contact: <span class="text-bold">ISPG Policy Team</span><span class="hidden-mobile"> | </span><span class="break-mobile"><a href="mailto:CISO@cms.hhs.gov">CISO@cms.hhs.gov</a></span></div></div><div class="tablet:position-absolute tablet:top-0"><div class="[ flow ] bg-primary-light radius-lg padding-2 text-base-darkest maxw-mobile"><div class="display-flex flex-align-center font-sans-lg margin-bottom-2 text-italic desktop:text-no-wrap"><img alt="slack logo" loading="lazy" width="21" height="21" decoding="async" data-nimg="1" class="display-inline margin-right-1" style="color:transparent" src="/_next/static/media/slackLogo.f5836093.svg"/>CMS Slack Channel</div><ul class="add-list-reset"><li class="line-height-sans-5 margin-top-0">#ispg-sec_privacy-policy</li></ul></div></div></div></div></div></section><div class="grid-container"><div class="grid-row grid-gap margin-top-5"><div class="tablet:grid-col-4"><nav class="table-of-contents overflow-y-auto overflow-x-hidden position-sticky top-3 padding-1 radius-lg shadow-2 display-none tablet:display-block" aria-label="Table of contents"><div class="text-uppercase text-bold border-bottom border-base-lighter padding-bottom-1">Table of Contents</div><p class="text-italic text-base font-sans-xs">No table of content entries to display.</p></nav></div><div class="tablet:grid-col-8 content"><section><div class="text-block text-block--theme-explainer"><p>For definitions of cybersecurity and privacy terms, we use the online glossary provided by the National Institute of Standards and Technology (NIST). <a href="https://csrc.nist.gov/glossary?index=A">Visit the NIST glossary here</a>.</p><p>For CMS security and privacy acronyms, see the list below.</p><h2>A - C</h2><p>AC - Access Control</p><p>ADO - Application Development Organization</p><p>AO - Authorizing Official</p><p>ARS - Acceptable Risk Safeguards</p><p>ASFR - Assistant Secretary for Financial Resources</p><p>ATO - Authority to Operate</p><p>AT - Awareness and Training</p><p>AU - Audit and Accountability</p><p>AV - Anti-Virus</p><p>BAA - Business Associate Agreement</p><p>BAT - Breach Analysis Team</p><p>BOD - Binding Operational Directive</p><p>CA - Security Assessment and Authorization</p><p>CAO - Chief Acquisition Officer</p><p>CCB - Change Control Board</p><p>CCIC - CMS Cybersecurity Integration Center</p><p>CDM - Continuous Diagnostics and Mitigation</p><p>CDO - Chief Data Officer</p><p>CFACTS - CMS FISMA Continuous Tracking System</p><p>CFO - Chief Financial Officer</p><p>CFR - Code of Federal Regulations</p><p>CHIP - Children’s Health Insurance Program</p><p>CIO - Chief Information Officer</p><p>CISO - Chief Information Security Officer</p><p>CLD - Cloud Computing</p><p>CMS IS2P2 - CMS Information Systems Security and Privacy Policy</p><p>CM - Configuration Management</p><p>CMA - Computer Matching Agreements</p><p>CMS - Centers for Medicare & Medicaid Services</p><p>CMS CLD - CMS Cloud Computing</p><p>CO - Contracting Officer</p><p>COO - Chief Operating Officer</p><p>COOP - Continuity of Operations</p><p>COR - Contracting Officer’s Representative</p><p>CP - Contingency Planning</p><p>CPIC - Capital Planning and Investment Control</p><p>CRA - Cyber Risk Advisor</p><p>CTO - Chief Technology Officer</p><p>CSIRC - Computer Security Incident Response Center</p><p>CSP - Cloud Service Provider</p><p>CSRAP - Cybersecurity Risk Assessment Program</p><p>CTI - Cyber Threat Intelligence</p><h2>D - I</h2><p>DGB - Data Governance Board</p><p>DHS - Department of Homeland Security</p><p>DI - Data Quality and Integrity</p><p>DIB - Data Integrity Board</p><p>DoD - Department of Defense</p><p>DSI - Physical Security and Strategic Information</p><p>DUA - Data Use Agreement</p><p>EA - Enterprise Architecture</p><p>EPLC - Enterprise Performance Life Cycle</p><p>E.O. - Executive Order</p><p>EOD - Entry on Duty</p><p>FedRAMP - Federal Risk and Authorization Management Program</p><p>FIPP - Fair Information Practice Principles</p><p>FIPS - Federal Information Processing Standard</p><p>FISCAM - Federal Information Systems Controls Audit Manual</p><p>FISMA - Federal Information Security Modernization Act of 2014</p><p>FOIA - Freedom of Information Act</p><p>FTI - Federal Tax Information</p><p>GAO - Government Accountability Office</p><p>HHS - Department of Health and Human Services</p><p>HHSAR - Health and Human Services Acquisition Regulation</p><p>HIDS - Host-Based Intrusion Detection System</p><p>HIM - Health Insurance Marketplace</p><p>HIPAA - Health Insurance Portability and Accountability Act of 1996</p><p>HITECH - Health Information Technology for Economic and Clinical Health</p><p>HSTS - HTTP Strict Transport Security</p><p>HTTP - Hypertext Transport Protocol</p><p>HVA - High Value Asset</p><p>IA - Identification and Authentication</p><p>IEC - International Electro Technical Commission</p><p>IOC - Indicators of Compromise</p><p>IP - Individual Participation and Redress</p><p>IR - Incident Response</p><p>IRS - Internal Revenue Service</p><p>IRT - Incident Response Team</p><p>IS2P - HHS Information Systems Security and Privacy Policy</p><p>IS2P2 - CMS Information Systems Security and Privacy Policy</p><p>ISA - Information Sharing Agreement</p><p>ISCM - Information Security Continuous Monitoring</p><p>ISCP - Information System Contingency Plan</p><p>ISO - Information System Owner, Information Security Officer, International Standards Organization</p><p>ISPG - Information Security and Privacy Group</p><p>ISRA - Information Security Risk Assessment</p><p>ISSO - Information System Security Officer</p><p>ISSOaas - ISSO As A Service</p><p>ISSOCS - ISSO Contractor Support</p><p>IT - Information Technology</p><p>ITIRB - IT Investment Review Board</p><h2>J - P</h2><p>LDS - Limited Data Set</p><p>MA - Maintenance</p><p>MOA - Memorandum of Agreement</p><p>MOU - Memorandum of Understanding</p><p>MP - Media Protection</p><p>MTD - Maximum Tolerable Downtime</p><p>NARA - National Archives and Records Administration</p><p>NICE - National Initiative for Cybersecurity Education</p><p>NIST - National Institute of Standards and Technology</p><p>NSA - National Security Agency</p><p>NSL - National Security Letter</p><p>O&M - Operations and Maintenance</p><p>OA - Office of the Administrator</p><p>OAGM - Office of Accounts and Grants Management</p><p>OE - Operations Executive</p><p>OEDA - Office of Enterprise Data and Analytics</p><p>OGAPA - Office of Grants and Acquisition Policy and Accountability</p><p>OGC - Office of General Counsel</p><p>OIG - Office of the Inspector General</p><p>OIT - Office of Information Technology</p><p>OMB - Office of Management and Budget</p><p>OPDIV - Operating Division</p><p>OSSI - Office of Security and Strategic Information</p><p>PE - Physical and Environmental Protection</p><p>PHI - Protected Health Information</p><p>PIA - Privacy Impact Assessment</p><p>PII - Personally Identifiable Information</p><p>PIRT - Privacy Incident Response Team</p><p>PIV - Personal Identity Verification</p><p>PL - Planning</p><p>PM - Program Management</p><p>PMO - Program Management Office</p><p>POA&M - Plan of Action and Milestones</p><p>POC - Point of Contact</p><p>PPSO - Personnel and Physical Security Officer</p><p>PS - Personnel Security</p><p>PSME - Privacy Subject Matter Expert</p><h2>R - Z</h2><p>RA - Risk Assessment</p><p>RBT - Role-Based Training</p><p>RMF - Risk Management Framework</p><p>RMH - Risk Management Handbook (this is <a href="https://security.cms.gov/posts/ispg-will-transition-away-using-risk-management-handbook">being retired</a>)</p><p>RoB - Rules of Behavior</p><p>RPO - Recovery Point Objective</p><p>RTO - Recovery Time Objective</p><p>SA - System and Services Acquisition</p><p>SA&A - Security Assessment and Authorization</p><p>SA&E - Security Architecture and Engineering</p><p>SC - System and Communications Protection</p><p>SCRM - Supply Chain Risk Management</p><p>SDLC - System Development Life Cycle</p><p>SE - Security</p><p>SES - Senior Executive Service</p><p>SI - System and Information Integrity</p><p>SIA - Security Impact Analysis</p><p>SOC - Security Operations Center</p><p>SOP - Senior Official for Privacy, Standard Operating Procedure</p><p>SOR - System of Records</p><p>SORN - System of Records Notice</p><p>SOW - Statement of Work</p><p>SP - Special Publication</p><p>SPMC - Strategic Planning Management Council</p><p>SSPP - System Security and Privacy Plan</p><p>SSR - Significant Security Responsibilities</p><p>TLS - Transport Layer Security</p><p>TR - Transparency</p><p>TRB - Technical Review Board</p><p>TRA - Technical Reference Architecture</p><p>UL - Use Limitation</p><p>USC - United States Code</p></div></section></div></div></div></div></main><footer class="usa-footer usa-footer--slim"><div class="grid-container"><div class="grid-row flex-align-end"><div class="grid-col"><div class="usa-footer__return-to-top"><a class="font-sans-xs" href="#">Return to top</a></div></div><div class="grid-col padding-bottom-2 padding-top-4 display-flex flex-justify-end"><a class="usa-button" href="/feedback">Give feedback</a></div></div></div><div class="usa-footer__primary-section"><div class="usa-footer__primary-container grid-row"><div class="tablet:grid-col-3"><a class="usa-footer__primary-link" href="/"><img alt="CyberGeek logo" loading="lazy" width="142" height="26" decoding="async" data-nimg="1" style="color:transparent" src="/_next/static/media/CyberGeek-logo.8e9bbd2b.svg"/></a><p class="usa-footer__logo-heading display-none tablet-lg:display-block">The official website of the CMS Information Security and Privacy Group (ISPG)</p></div><div class="tablet:grid-col-12 tablet-lg:grid-col-9"><nav class="usa-footer__nav" aria-label="Footer navigation,"><ul class="grid-row grid-gap"><li class=" tablet:grid-col-3 desktop:grid-col-auto usa-footer__primary-content "><a class="usa-footer__primary-link" href="/learn/about-ispg-cybergeek">What is CyberGeek?</a></li><li class=" tablet:grid-col-3 desktop:grid-col-auto usa-footer__primary-content "><a class="usa-footer__primary-link" href="https://www.cms.gov/privacy">Privacy policy</a></li><li class=" tablet:grid-col-3 desktop:grid-col-auto usa-footer__primary-content "><a class="usa-footer__primary-link" href="https://www.cms.gov/about-cms/information-systems/privacy/vulnerability-disclosure-policy">CMS Vulnerability Disclosure Policy</a></li><li class=" tablet:grid-col-3 desktop:grid-col-auto usa-footer__primary-content "><a class="usa-footer__primary-link" href="https://www.cms.gov/About-CMS/Agency-Information/Aboutwebsite/Policiesforaccessibility">Accessibility</a></li></ul></nav></div></div></div><div class="usa-footer__secondary-section"><div class="grid-container"><div class="usa-footer__logo grid-row grid-gap-2"><div class="mobile-lg:grid-col-3"><a href="https://www.cms.gov/"><img alt="CMS homepage" loading="lazy" width="124" height="29" decoding="async" data-nimg="1" style="color:transparent" src="/_next/static/media/cmsLogo.10a64ce4.svg"/></a></div><div class="mobile-lg:grid-col-7"><p class="font-sans-3xs line-height-sans-3">A federal government website managed and paid for by the U.S. Centers for Medicare & Medicaid Services.</p><address class="font-sans-3xs line-height-sans-3">7500 Security Boulevard, Baltimore, MD 21244</address></div></div></div></div></footer><script>(self.__next_s=self.__next_s||[]).push(["/assets/javascript/uswds.min.js",{}])</script><script src="/_next/static/chunks/webpack-182b67d00f496f9d.js" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0]);self.__next_f.push([2,null])</script><script>self.__next_f.push([1,"1:HL[\"/_next/static/css/ef46db3751d8e999.css\",\"style\"]\n2:HL[\"/_next/static/css/0759e90f4fecfde7.css\",\"style\"]\n"])</script><script>self.__next_f.push([1,"3:I[5751,[],\"\"]\n6:I[9275,[],\"\"]\n8:I[1343,[],\"\"]\nb:I[6130,[],\"\"]\n7:[\"slug\",\"acronyms\",\"d\"]\nc:[]\n0:[\"$\",\"$L3\",null,{\"buildId\":\"m9SaS4P6zugJbBHpXSk5Y\",\"assetPrefix\":\"\",\"urlParts\":[\"\",\"learn\",\"acronyms\"],\"initialTree\":[\"\",{\"children\":[\"learn\",{\"children\":[[\"slug\",\"acronyms\",\"d\"],{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],\"initialSeedData\":[\"\",{\"children\":[\"learn\",{\"children\":[[\"slug\",\"acronyms\",\"d\"],{\"children\":[\"__PAGE__\",{},[[\"$L4\",\"$L5\",null],null],null]},[null,[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\",\"learn\",\"children\",\"$7\",\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L8\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"notFoundStyles\":\"$undefined\"}]],null]},[null,[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\",\"learn\",\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L8\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"notFoundStyles\":\"$undefined\"}]],null]},[[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/ef46db3751d8e999.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/0759e90f4fecfde7.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\"}]],\"$L9\"],null],null],\"couldBeIntercepted\":false,\"initialHead\":[null,\"$La\"],\"globalErrorComponent\":\"$b\",\"missingSlots\":\"$Wc\"}]\n"])</script><script>self.__next_f.push([1,"d:I[4080,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"223\",\"static/chunks/223-bc9ed43510898bbb.js\",\"185\",\"static/chunks/app/layout-9fc24027bc047aa2.js\"],\"\"]\ne:I[8173,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"972\",\"static/chunks/972-6e520d137ef194fb.js\",\"931\",\"static/chunks/app/page-cc829e051925e906.js\"],\"Image\"]\nf:I[7529,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"223\",\"static/chunks/223-bc9ed43510898bbb.js\",\"185\",\"static/chunks/app/layout-9fc24027bc047aa2.js\"],\"default\"]\n11:I[231,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"972\",\"static/chunks/972-6e520d137ef194fb.js\",\"931\",\"static/chunks/app/page-cc829e051925e906.js\"],\"\"]\n12:I[7303,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"223\",\"static/chunks/223-bc9ed43510898bbb.js\",\"185\",\"static/chunks/app/layout-9fc24027bc047aa2.js\"],\"default\"]\n13:I[8521,[\"489\",\"static/chunks/app/template-d264bab5e3061841.js\"],\"default\"]\n14:I[5922,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"972\",\"static/chunks/972-6e520d137ef194fb.js\",\"931\",\"static/chunks/app/page-cc829e051925e906.js\"],\"default\"]\n15:I[7182,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"223\",\"static/chunks/223-bc9ed43510898bbb.js\",\"185\",\"static/chunks/app/layout-9fc24027bc047aa2.js\"],\"default\"]\n16:I[4180,[\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"223\",\"static/chunks/223-bc9ed43510898bbb.js\",\"185\",\"static/chunks/app/layout-9fc24027bc047aa2.js\"],\"TealiumTagManager\"]\n10:Tdced,"])</script><script>self.__next_f.push([1,"{\"id\":\"mega-menu\",\"linkset\":{\"elements\":[{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Roles\",\"hierarchy\":[\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/information-system-security-officer-isso\",\"attributes\":{\"title\":\"Information System Security Officer (ISSO)\",\"hierarchy\":[\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook\",\"attributes\":{\"title\":\"ISSO Handbook\",\"hierarchy\":[\"0\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook#getting-started-for-new-issos\",\"attributes\":{\"title\":\"Getting started (for new ISSOs)\",\"hierarchy\":[\"0\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/isso-mentorship-program\",\"attributes\":{\"title\":\"ISSO Mentorship Program\",\"hierarchy\":[\"0\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook#training\",\"attributes\":{\"title\":\"ISSO Training\",\"hierarchy\":[\"0\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/data-guardian\",\"attributes\":{\"title\":\"Data Guardian\",\"hierarchy\":[\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/data-guardian-handbook\",\"attributes\":{\"title\":\"Data Guardian Handbook\",\"hierarchy\":[\"0\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/cyber-risk-advisor-cra\",\"attributes\":{\"title\":\"Cyber Risk Advisor (CRA)\",\"hierarchy\":[\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks\",\"attributes\":{\"title\":\"CMS Security and Privacy Handbooks\",\"hierarchy\":[\"0\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks#risk-management-handbook-rmh-chapters\",\"attributes\":{\"title\":\"Risk Management Handbook (RMH)\",\"hierarchy\":[\"0\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/business-system-owner\",\"attributes\":{\"title\":\"Business / System Owner (BO/SO)\",\"hierarchy\":[\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity and Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"0\",\"3\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-information-exchange-agreement-iea\",\"attributes\":{\"title\":\"Information Exchange Agreement (IEA)\",\"hierarchy\":[\"0\",\"3\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-computer-matching-agreement-cma\",\"attributes\":{\"title\":\"Computer Matching Agreement (CMA)\",\"hierarchy\":[\"0\",\"3\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/isso-service\",\"attributes\":{\"title\":\"ISSO As A Service\",\"hierarchy\":[\"0\",\"3\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Compliance \u0026 Authorization\",\"hierarchy\":[\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato\",\"attributes\":{\"title\":\"Authorization to Operate (ATO)\",\"hierarchy\":[\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato\",\"attributes\":{\"title\":\"About ATO at CMS\",\"hierarchy\":[\"1\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#types-of-authorizations\",\"attributes\":{\"title\":\"Types of authorizations\",\"hierarchy\":[\"1\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#ato-stakeholders\",\"attributes\":{\"title\":\"ATO stakeholders\",\"hierarchy\":[\"1\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#related-documents-and-resources\",\"attributes\":{\"title\":\"ATO tools and resources\",\"hierarchy\":[\"1\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-technical-reference-architecture-tra\",\"attributes\":{\"title\":\"CMS Technical Reference Architecture (TRA)\",\"hierarchy\":[\"1\",\"0\",\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa\",\"attributes\":{\"title\":\"Ongoing Authorization (OA)\",\"hierarchy\":[\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa\",\"attributes\":{\"title\":\"About OA at CMS\",\"hierarchy\":[\"1\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa#is-my-system-eligible-for-oa\",\"attributes\":{\"title\":\"OA eligibility requirements\",\"hierarchy\":[\"1\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"1\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Assessments \u0026 Audits\",\"hierarchy\":[\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"1\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"1\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"1\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/security-impact-analysis-sia\",\"attributes\":{\"title\":\"Security Impact Analysis (SIA)\",\"hierarchy\":[\"1\",\"2\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/system-audits\",\"attributes\":{\"title\":\"System Audits\",\"hierarchy\":[\"1\",\"2\",\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Policy \u0026 Guidance\",\"hierarchy\":[\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/cms-policies-and-guidance\",\"attributes\":{\"title\":\"CMS Policies and Guidance\",\"hierarchy\":[\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-acceptable-risk-safeguards-ars\",\"attributes\":{\"title\":\"CMS Acceptable Risk Safeguards (ARS)\",\"hierarchy\":[\"2\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-systems-security-privacy-policy-is2p2\",\"attributes\":{\"title\":\"CMS Information Security and Privacy Policy (IS2P2)\",\"hierarchy\":[\"2\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks\",\"attributes\":{\"title\":\"CMS Security and Privacy Handbooks\",\"hierarchy\":[\"2\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/cms-risk-management-framework-rmf\",\"attributes\":{\"title\":\"CMS Risk Management Framework (RMF)\",\"hierarchy\":[\"2\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/email-encryption-requirements-cms\",\"attributes\":{\"title\":\"CMS Email Encryption\",\"hierarchy\":[\"2\",\"0\",\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/federal-policies-and-guidance\",\"attributes\":{\"title\":\"Federal Policies and Guidance\",\"hierarchy\":[\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/national-institute-standards-and-technology-nist\",\"attributes\":{\"title\":\"National Institute of Standards and Technology (NIST)\",\"hierarchy\":[\"2\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/federal-information-security-modernization-act-fisma\",\"attributes\":{\"title\":\"Federal Information Security Modernization Act (FISMA)\",\"hierarchy\":[\"2\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/fedramp\",\"attributes\":{\"title\":\"Federal Risk and Authorization Management Program (FedRAMP)\",\"hierarchy\":[\"2\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/zero-trust\",\"attributes\":{\"title\":\"Zero Trust\",\"hierarchy\":[\"2\",\"1\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"System Security\",\"hierarchy\":[\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/application-security\",\"attributes\":{\"title\":\"Application Security\",\"hierarchy\":[\"3\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/threat-modeling\",\"attributes\":{\"title\":\"Threat Modeling\",\"hierarchy\":[\"3\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/zero-trust\",\"attributes\":{\"title\":\"Zero Trust\",\"hierarchy\":[\"3\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cloud-services\",\"attributes\":{\"title\":\"CMS Cloud Services\",\"hierarchy\":[\"3\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/software-bill-materials-sbom\",\"attributes\":{\"title\":\"Software Bill of Materials (SBOM)\",\"hierarchy\":[\"3\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/security-operations\",\"attributes\":{\"title\":\"Security Operations\",\"hierarchy\":[\"3\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/risk-management-handbook-chapter-8-incident-response-ir\",\"attributes\":{\"title\":\"Incident Response\",\"hierarchy\":[\"3\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cybersecurity-integration-center-ccic\",\"attributes\":{\"title\":\"CMS Cybersecurity Integration Center (CCIC)\",\"hierarchy\":[\"3\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"3\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/risk-management-and-reporting\",\"attributes\":{\"title\":\"Risk Management and Reporting\",\"hierarchy\":[\"3\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"3\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cyber-risk-reports\",\"attributes\":{\"title\":\"Cyber Risk Reports\",\"hierarchy\":[\"3\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/plan-action-and-milestones-poam\",\"attributes\":{\"title\":\"Plan of Action and Milestones (POA\u0026M)\",\"hierarchy\":[\"3\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy\",\"hierarchy\":[\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Agreements\",\"hierarchy\":[\"4\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-computer-matching-agreement-cma\",\"attributes\":{\"title\":\"Computer Matching Agreement (CMA)\",\"hierarchy\":[\"4\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-information-exchange-agreement-iea\",\"attributes\":{\"title\":\"Information Exchange Agreement (IEA)\",\"hierarchy\":[\"4\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy Activities\",\"hierarchy\":[\"4\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/breach-response\",\"attributes\":{\"title\":\"Breach Response\",\"hierarchy\":[\"4\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"4\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/system-records-notice-sorn\",\"attributes\":{\"title\":\"System of Records Notice (SORN)\",\"hierarchy\":[\"4\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy Resources\",\"hierarchy\":[\"4\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/privacy\",\"attributes\":{\"title\":\"Privacy at CMS\",\"hierarchy\":[\"4\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-breach-response-handbook\",\"attributes\":{\"title\":\"CMS Breach Response Handbook\",\"hierarchy\":[\"4\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/health-insurance-portability-and-accountability-act-1996-hipaa\",\"attributes\":{\"title\":\"Health Insurance Portability and Accessibility Act (HIPAA)\",\"hierarchy\":[\"4\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-privacy-impact-assessment-pia-handbook\",\"attributes\":{\"title\":\"CMS Privacy Impact Assessment (PIA) Handbook\",\"hierarchy\":[\"4\",\"2\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Tools \u0026 Services\",\"hierarchy\":[\"5\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Reporting \u0026 Compliance\",\"hierarchy\":[\"5\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/isso-service\",\"attributes\":{\"title\":\"ISSO As A Service\",\"hierarchy\":[\"5\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-fisma-continuous-tracking-system-cfacts\",\"attributes\":{\"title\":\"CFACTS\",\"hierarchy\":[\"5\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cyber-risk-reports\",\"attributes\":{\"title\":\"Cyber Risk Reports and Dashboards\",\"hierarchy\":[\"5\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"5\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"System Security\",\"hierarchy\":[\"5\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/threat-modeling\",\"attributes\":{\"title\":\"Threat Modeling\",\"hierarchy\":[\"5\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cloud-services\",\"attributes\":{\"title\":\"CMS Cloud Services\",\"hierarchy\":[\"5\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cybersecurity-integration-center-ccic\",\"attributes\":{\"title\":\"CMS Cybersecurity Integration Center (CCIC)\",\"hierarchy\":[\"5\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/cms-security-data-lake-sdl\",\"attributes\":{\"title\":\"CMS Security Data Lake (SDL)\",\"hierarchy\":[\"5\",\"1\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Tests \u0026 Assessments\",\"hierarchy\":[\"5\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"5\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"5\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"5\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}}],\"size\":87},\"elements\":[{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Roles\",\"hierarchy\":[\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/information-system-security-officer-isso\",\"attributes\":{\"title\":\"Information System Security Officer (ISSO)\",\"hierarchy\":[\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook\",\"attributes\":{\"title\":\"ISSO Handbook\",\"hierarchy\":[\"0\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook#getting-started-for-new-issos\",\"attributes\":{\"title\":\"Getting started (for new ISSOs)\",\"hierarchy\":[\"0\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/isso-mentorship-program\",\"attributes\":{\"title\":\"ISSO Mentorship Program\",\"hierarchy\":[\"0\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook#training\",\"attributes\":{\"title\":\"ISSO Training\",\"hierarchy\":[\"0\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/data-guardian\",\"attributes\":{\"title\":\"Data Guardian\",\"hierarchy\":[\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/data-guardian-handbook\",\"attributes\":{\"title\":\"Data Guardian Handbook\",\"hierarchy\":[\"0\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/cyber-risk-advisor-cra\",\"attributes\":{\"title\":\"Cyber Risk Advisor (CRA)\",\"hierarchy\":[\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks\",\"attributes\":{\"title\":\"CMS Security and Privacy Handbooks\",\"hierarchy\":[\"0\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks#risk-management-handbook-rmh-chapters\",\"attributes\":{\"title\":\"Risk Management Handbook (RMH)\",\"hierarchy\":[\"0\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/business-system-owner\",\"attributes\":{\"title\":\"Business / System Owner (BO/SO)\",\"hierarchy\":[\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity and Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"0\",\"3\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-information-exchange-agreement-iea\",\"attributes\":{\"title\":\"Information Exchange Agreement (IEA)\",\"hierarchy\":[\"0\",\"3\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-computer-matching-agreement-cma\",\"attributes\":{\"title\":\"Computer Matching Agreement (CMA)\",\"hierarchy\":[\"0\",\"3\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/isso-service\",\"attributes\":{\"title\":\"ISSO As A Service\",\"hierarchy\":[\"0\",\"3\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Compliance \u0026 Authorization\",\"hierarchy\":[\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato\",\"attributes\":{\"title\":\"Authorization to Operate (ATO)\",\"hierarchy\":[\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato\",\"attributes\":{\"title\":\"About ATO at CMS\",\"hierarchy\":[\"1\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#types-of-authorizations\",\"attributes\":{\"title\":\"Types of authorizations\",\"hierarchy\":[\"1\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#ato-stakeholders\",\"attributes\":{\"title\":\"ATO stakeholders\",\"hierarchy\":[\"1\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#related-documents-and-resources\",\"attributes\":{\"title\":\"ATO tools and resources\",\"hierarchy\":[\"1\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-technical-reference-architecture-tra\",\"attributes\":{\"title\":\"CMS Technical Reference Architecture (TRA)\",\"hierarchy\":[\"1\",\"0\",\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa\",\"attributes\":{\"title\":\"Ongoing Authorization (OA)\",\"hierarchy\":[\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa\",\"attributes\":{\"title\":\"About OA at CMS\",\"hierarchy\":[\"1\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa#is-my-system-eligible-for-oa\",\"attributes\":{\"title\":\"OA eligibility requirements\",\"hierarchy\":[\"1\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"1\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Assessments \u0026 Audits\",\"hierarchy\":[\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"1\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"1\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"1\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/security-impact-analysis-sia\",\"attributes\":{\"title\":\"Security Impact Analysis (SIA)\",\"hierarchy\":[\"1\",\"2\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/system-audits\",\"attributes\":{\"title\":\"System Audits\",\"hierarchy\":[\"1\",\"2\",\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Policy \u0026 Guidance\",\"hierarchy\":[\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/cms-policies-and-guidance\",\"attributes\":{\"title\":\"CMS Policies and Guidance\",\"hierarchy\":[\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-acceptable-risk-safeguards-ars\",\"attributes\":{\"title\":\"CMS Acceptable Risk Safeguards (ARS)\",\"hierarchy\":[\"2\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-systems-security-privacy-policy-is2p2\",\"attributes\":{\"title\":\"CMS Information Security and Privacy Policy (IS2P2)\",\"hierarchy\":[\"2\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks\",\"attributes\":{\"title\":\"CMS Security and Privacy Handbooks\",\"hierarchy\":[\"2\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/cms-risk-management-framework-rmf\",\"attributes\":{\"title\":\"CMS Risk Management Framework (RMF)\",\"hierarchy\":[\"2\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/email-encryption-requirements-cms\",\"attributes\":{\"title\":\"CMS Email Encryption\",\"hierarchy\":[\"2\",\"0\",\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/federal-policies-and-guidance\",\"attributes\":{\"title\":\"Federal Policies and Guidance\",\"hierarchy\":[\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/national-institute-standards-and-technology-nist\",\"attributes\":{\"title\":\"National Institute of Standards and Technology (NIST)\",\"hierarchy\":[\"2\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/federal-information-security-modernization-act-fisma\",\"attributes\":{\"title\":\"Federal Information Security Modernization Act (FISMA)\",\"hierarchy\":[\"2\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/fedramp\",\"attributes\":{\"title\":\"Federal Risk and Authorization Management Program (FedRAMP)\",\"hierarchy\":[\"2\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/zero-trust\",\"attributes\":{\"title\":\"Zero Trust\",\"hierarchy\":[\"2\",\"1\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"System Security\",\"hierarchy\":[\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/application-security\",\"attributes\":{\"title\":\"Application Security\",\"hierarchy\":[\"3\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/threat-modeling\",\"attributes\":{\"title\":\"Threat Modeling\",\"hierarchy\":[\"3\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/zero-trust\",\"attributes\":{\"title\":\"Zero Trust\",\"hierarchy\":[\"3\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cloud-services\",\"attributes\":{\"title\":\"CMS Cloud Services\",\"hierarchy\":[\"3\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/software-bill-materials-sbom\",\"attributes\":{\"title\":\"Software Bill of Materials (SBOM)\",\"hierarchy\":[\"3\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/security-operations\",\"attributes\":{\"title\":\"Security Operations\",\"hierarchy\":[\"3\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/risk-management-handbook-chapter-8-incident-response-ir\",\"attributes\":{\"title\":\"Incident Response\",\"hierarchy\":[\"3\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cybersecurity-integration-center-ccic\",\"attributes\":{\"title\":\"CMS Cybersecurity Integration Center (CCIC)\",\"hierarchy\":[\"3\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"3\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/risk-management-and-reporting\",\"attributes\":{\"title\":\"Risk Management and Reporting\",\"hierarchy\":[\"3\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"3\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cyber-risk-reports\",\"attributes\":{\"title\":\"Cyber Risk Reports\",\"hierarchy\":[\"3\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/plan-action-and-milestones-poam\",\"attributes\":{\"title\":\"Plan of Action and Milestones (POA\u0026M)\",\"hierarchy\":[\"3\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy\",\"hierarchy\":[\"4\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Agreements\",\"hierarchy\":[\"4\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-computer-matching-agreement-cma\",\"attributes\":{\"title\":\"Computer Matching Agreement (CMA)\",\"hierarchy\":[\"4\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-information-exchange-agreement-iea\",\"attributes\":{\"title\":\"Information Exchange Agreement (IEA)\",\"hierarchy\":[\"4\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy Activities\",\"hierarchy\":[\"4\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/breach-response\",\"attributes\":{\"title\":\"Breach Response\",\"hierarchy\":[\"4\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"4\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/system-records-notice-sorn\",\"attributes\":{\"title\":\"System of Records Notice (SORN)\",\"hierarchy\":[\"4\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy Resources\",\"hierarchy\":[\"4\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/privacy\",\"attributes\":{\"title\":\"Privacy at CMS\",\"hierarchy\":[\"4\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-breach-response-handbook\",\"attributes\":{\"title\":\"CMS Breach Response Handbook\",\"hierarchy\":[\"4\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/health-insurance-portability-and-accountability-act-1996-hipaa\",\"attributes\":{\"title\":\"Health Insurance Portability and Accessibility Act (HIPAA)\",\"hierarchy\":[\"4\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-privacy-impact-assessment-pia-handbook\",\"attributes\":{\"title\":\"CMS Privacy Impact Assessment (PIA) Handbook\",\"hierarchy\":[\"4\",\"2\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Tools \u0026 Services\",\"hierarchy\":[\"5\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Reporting \u0026 Compliance\",\"hierarchy\":[\"5\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/isso-service\",\"attributes\":{\"title\":\"ISSO As A Service\",\"hierarchy\":[\"5\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-fisma-continuous-tracking-system-cfacts\",\"attributes\":{\"title\":\"CFACTS\",\"hierarchy\":[\"5\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cyber-risk-reports\",\"attributes\":{\"title\":\"Cyber Risk Reports and Dashboards\",\"hierarchy\":[\"5\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"5\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"System Security\",\"hierarchy\":[\"5\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/threat-modeling\",\"attributes\":{\"title\":\"Threat Modeling\",\"hierarchy\":[\"5\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cloud-services\",\"attributes\":{\"title\":\"CMS Cloud Services\",\"hierarchy\":[\"5\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cybersecurity-integration-center-ccic\",\"attributes\":{\"title\":\"CMS Cybersecurity Integration Center (CCIC)\",\"hierarchy\":[\"5\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/cms-security-data-lake-sdl\",\"attributes\":{\"title\":\"CMS Security Data Lake (SDL)\",\"hierarchy\":[\"5\",\"1\",\"3\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Tests \u0026 Assessments\",\"hierarchy\":[\"5\",\"2\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"5\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"5\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"5\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}}],\"size\":87,\"tree\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Roles\",\"hierarchy\":[\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/information-system-security-officer-isso\",\"attributes\":{\"title\":\"Information System Security Officer (ISSO)\",\"hierarchy\":[\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook\",\"attributes\":{\"title\":\"ISSO Handbook\",\"hierarchy\":[\"0\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook#getting-started-for-new-issos\",\"attributes\":{\"title\":\"Getting started (for new ISSOs)\",\"hierarchy\":[\"0\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/isso-mentorship-program\",\"attributes\":{\"title\":\"ISSO Mentorship Program\",\"hierarchy\":[\"0\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-system-security-officer-isso-handbook#training\",\"attributes\":{\"title\":\"ISSO Training\",\"hierarchy\":[\"0\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/data-guardian\",\"attributes\":{\"title\":\"Data Guardian\",\"hierarchy\":[\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/data-guardian-handbook\",\"attributes\":{\"title\":\"Data Guardian Handbook\",\"hierarchy\":[\"0\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/cyber-risk-advisor-cra\",\"attributes\":{\"title\":\"Cyber Risk Advisor (CRA)\",\"hierarchy\":[\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks\",\"attributes\":{\"title\":\"CMS Security and Privacy Handbooks\",\"hierarchy\":[\"0\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks#risk-management-handbook-rmh-chapters\",\"attributes\":{\"title\":\"Risk Management Handbook (RMH)\",\"hierarchy\":[\"0\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/business-system-owner\",\"attributes\":{\"title\":\"Business / System Owner (BO/SO)\",\"hierarchy\":[\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity and Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"0\",\"3\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-information-exchange-agreement-iea\",\"attributes\":{\"title\":\"Information Exchange Agreement (IEA)\",\"hierarchy\":[\"0\",\"3\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-computer-matching-agreement-cma\",\"attributes\":{\"title\":\"Computer Matching Agreement (CMA)\",\"hierarchy\":[\"0\",\"3\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/isso-service\",\"attributes\":{\"title\":\"ISSO As A Service\",\"hierarchy\":[\"0\",\"3\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Compliance \u0026 Authorization\",\"hierarchy\":[\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato\",\"attributes\":{\"title\":\"Authorization to Operate (ATO)\",\"hierarchy\":[\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato\",\"attributes\":{\"title\":\"About ATO at CMS\",\"hierarchy\":[\"1\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#types-of-authorizations\",\"attributes\":{\"title\":\"Types of authorizations\",\"hierarchy\":[\"1\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#ato-stakeholders\",\"attributes\":{\"title\":\"ATO stakeholders\",\"hierarchy\":[\"1\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/authorization-operate-ato#related-documents-and-resources\",\"attributes\":{\"title\":\"ATO tools and resources\",\"hierarchy\":[\"1\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-technical-reference-architecture-tra\",\"attributes\":{\"title\":\"CMS Technical Reference Architecture (TRA)\",\"hierarchy\":[\"1\",\"0\",\"4\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa\",\"attributes\":{\"title\":\"Ongoing Authorization (OA)\",\"hierarchy\":[\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa\",\"attributes\":{\"title\":\"About OA at CMS\",\"hierarchy\":[\"1\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/ongoing-authorization-oa#is-my-system-eligible-for-oa\",\"attributes\":{\"title\":\"OA eligibility requirements\",\"hierarchy\":[\"1\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"1\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Assessments \u0026 Audits\",\"hierarchy\":[\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"1\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"1\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"1\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/security-impact-analysis-sia\",\"attributes\":{\"title\":\"Security Impact Analysis (SIA)\",\"hierarchy\":[\"1\",\"2\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/system-audits\",\"attributes\":{\"title\":\"System Audits\",\"hierarchy\":[\"1\",\"2\",\"4\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Policy \u0026 Guidance\",\"hierarchy\":[\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/cms-policies-and-guidance\",\"attributes\":{\"title\":\"CMS Policies and Guidance\",\"hierarchy\":[\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-acceptable-risk-safeguards-ars\",\"attributes\":{\"title\":\"CMS Acceptable Risk Safeguards (ARS)\",\"hierarchy\":[\"2\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-information-systems-security-privacy-policy-is2p2\",\"attributes\":{\"title\":\"CMS Information Security and Privacy Policy (IS2P2)\",\"hierarchy\":[\"2\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-security-and-privacy-handbooks\",\"attributes\":{\"title\":\"CMS Security and Privacy Handbooks\",\"hierarchy\":[\"2\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/cms-risk-management-framework-rmf\",\"attributes\":{\"title\":\"CMS Risk Management Framework (RMF)\",\"hierarchy\":[\"2\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/email-encryption-requirements-cms\",\"attributes\":{\"title\":\"CMS Email Encryption\",\"hierarchy\":[\"2\",\"0\",\"4\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/federal-policies-and-guidance\",\"attributes\":{\"title\":\"Federal Policies and Guidance\",\"hierarchy\":[\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/national-institute-standards-and-technology-nist\",\"attributes\":{\"title\":\"National Institute of Standards and Technology (NIST)\",\"hierarchy\":[\"2\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/federal-information-security-modernization-act-fisma\",\"attributes\":{\"title\":\"Federal Information Security Modernization Act (FISMA)\",\"hierarchy\":[\"2\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/fedramp\",\"attributes\":{\"title\":\"Federal Risk and Authorization Management Program (FedRAMP)\",\"hierarchy\":[\"2\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/zero-trust\",\"attributes\":{\"title\":\"Zero Trust\",\"hierarchy\":[\"2\",\"1\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"System Security\",\"hierarchy\":[\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/application-security\",\"attributes\":{\"title\":\"Application Security\",\"hierarchy\":[\"3\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/threat-modeling\",\"attributes\":{\"title\":\"Threat Modeling\",\"hierarchy\":[\"3\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/zero-trust\",\"attributes\":{\"title\":\"Zero Trust\",\"hierarchy\":[\"3\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cloud-services\",\"attributes\":{\"title\":\"CMS Cloud Services\",\"hierarchy\":[\"3\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/software-bill-materials-sbom\",\"attributes\":{\"title\":\"Software Bill of Materials (SBOM)\",\"hierarchy\":[\"3\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/security-operations\",\"attributes\":{\"title\":\"Security Operations\",\"hierarchy\":[\"3\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/risk-management-handbook-chapter-8-incident-response-ir\",\"attributes\":{\"title\":\"Incident Response\",\"hierarchy\":[\"3\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cybersecurity-integration-center-ccic\",\"attributes\":{\"title\":\"CMS Cybersecurity Integration Center (CCIC)\",\"hierarchy\":[\"3\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"3\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/risk-management-and-reporting\",\"attributes\":{\"title\":\"Risk Management and Reporting\",\"hierarchy\":[\"3\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"3\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cyber-risk-reports\",\"attributes\":{\"title\":\"Cyber Risk Reports\",\"hierarchy\":[\"3\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/plan-action-and-milestones-poam\",\"attributes\":{\"title\":\"Plan of Action and Milestones (POA\u0026M)\",\"hierarchy\":[\"3\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy\",\"hierarchy\":[\"4\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Agreements\",\"hierarchy\":[\"4\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-computer-matching-agreement-cma\",\"attributes\":{\"title\":\"Computer Matching Agreement (CMA)\",\"hierarchy\":[\"4\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-information-exchange-agreement-iea\",\"attributes\":{\"title\":\"Information Exchange Agreement (IEA)\",\"hierarchy\":[\"4\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy Activities\",\"hierarchy\":[\"4\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/breach-response\",\"attributes\":{\"title\":\"Breach Response\",\"hierarchy\":[\"4\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"4\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/system-records-notice-sorn\",\"attributes\":{\"title\":\"System of Records Notice (SORN)\",\"hierarchy\":[\"4\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Privacy Resources\",\"hierarchy\":[\"4\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/ispg/privacy\",\"attributes\":{\"title\":\"Privacy at CMS\",\"hierarchy\":[\"4\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-breach-response-handbook\",\"attributes\":{\"title\":\"CMS Breach Response Handbook\",\"hierarchy\":[\"4\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/health-insurance-portability-and-accountability-act-1996-hipaa\",\"attributes\":{\"title\":\"Health Insurance Portability and Accessibility Act (HIPAA)\",\"hierarchy\":[\"4\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/policy-guidance/cms-privacy-impact-assessment-pia-handbook\",\"attributes\":{\"title\":\"CMS Privacy Impact Assessment (PIA) Handbook\",\"hierarchy\":[\"4\",\"2\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Tools \u0026 Services\",\"hierarchy\":[\"5\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Reporting \u0026 Compliance\",\"hierarchy\":[\"5\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/isso-service\",\"attributes\":{\"title\":\"ISSO As A Service\",\"hierarchy\":[\"5\",\"0\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-fisma-continuous-tracking-system-cfacts\",\"attributes\":{\"title\":\"CFACTS\",\"hierarchy\":[\"5\",\"0\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cyber-risk-reports\",\"attributes\":{\"title\":\"Cyber Risk Reports and Dashboards\",\"hierarchy\":[\"5\",\"0\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/continuous-diagnostics-and-mitigation-cdm\",\"attributes\":{\"title\":\"Continuous Diagnostics and Mitigation (CDM)\",\"hierarchy\":[\"5\",\"0\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"System Security\",\"hierarchy\":[\"5\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/threat-modeling\",\"attributes\":{\"title\":\"Threat Modeling\",\"hierarchy\":[\"5\",\"1\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cloud-services\",\"attributes\":{\"title\":\"CMS Cloud Services\",\"hierarchy\":[\"5\",\"1\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cms-cybersecurity-integration-center-ccic\",\"attributes\":{\"title\":\"CMS Cybersecurity Integration Center (CCIC)\",\"hierarchy\":[\"5\",\"1\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"https://security.cms.gov/learn/cms-security-data-lake-sdl\",\"attributes\":{\"title\":\"CMS Security Data Lake (SDL)\",\"hierarchy\":[\"5\",\"1\",\"3\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"\",\"attributes\":{\"title\":\"Tests \u0026 Assessments\",\"hierarchy\":[\"5\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/cybersecurity-risk-assessment-program-csrap\",\"attributes\":{\"title\":\"Cybersecurity Risk Assessment Program (CSRAP)\",\"hierarchy\":[\"5\",\"2\",\"0\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/penetration-testing-pentesting\",\"attributes\":{\"title\":\"Penetration Testing\",\"hierarchy\":[\"5\",\"2\",\"1\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]},{\"link\":{\"anchor\":\"/system/menu/mega-menu/linkset\",\"rel\":\"item\",\"href\":\"/learn/privacy-impact-assessment-pia\",\"attributes\":{\"title\":\"Privacy Impact Assessment (PIA)\",\"hierarchy\":[\"5\",\"2\",\"2\"],\"machine-name\":[\"mega-menu\"]}},\"children\":[]}]}]}]}"])</script><script>self.__next_f.push([1,"9:[\"$\",\"html\",null,{\"lang\":\"en\",\"children\":[[\"$\",\"head\",null,{\"children\":[\"$\",\"$Ld\",null,{\"src\":\"/assets/javascript/uswds-init.min.js\",\"strategy\":\"beforeInteractive\"}]}],[\"$\",\"body\",null,{\"children\":[[[\"$\",\"a\",null,{\"className\":\"usa-skipnav\",\"href\":\"#main\",\"children\":\"Skip to main content\"}],[\"$\",\"section\",null,{\"className\":\"usa-banner\",\"aria-label\":\"Official website of the United States government\",\"children\":[\"$\",\"div\",null,{\"className\":\"usa-accordion\",\"children\":[[\"$\",\"header\",null,{\"className\":\"usa-banner__header\",\"children\":[\"$\",\"div\",null,{\"className\":\"usa-banner__inner\",\"children\":[[\"$\",\"div\",null,{\"className\":\"grid-col-auto\",\"children\":[\"$\",\"$Le\",null,{\"aria-hidden\":\"true\",\"className\":\"usa-banner__header-flag\",\"src\":\"/assets/img/us_flag_small.png\",\"alt\":\"\",\"width\":\"16\",\"height\":\"11\"}]}],[\"$\",\"div\",null,{\"className\":\"grid-col-fill tablet:grid-col-auto\",\"aria-hidden\":\"true\",\"children\":[[\"$\",\"p\",null,{\"className\":\"usa-banner__header-text\",\"children\":\"An official website of the United States government\"}],[\"$\",\"p\",null,{\"className\":\"usa-banner__header-action\",\"children\":\"Here's how you know\"}]]}],[\"$\",\"button\",null,{\"type\":\"button\",\"className\":\"usa-accordion__button usa-banner__button\",\"aria-expanded\":\"false\",\"aria-controls\":\"gov-banner-default-default\",\"children\":[\"$\",\"span\",null,{\"className\":\"usa-banner__button-text\",\"children\":\"Here's how you know\"}]}]]}]}],[\"$\",\"div\",null,{\"className\":\"usa-banner__content usa-accordion__content\",\"id\":\"gov-banner-default-default\",\"hidden\":true,\"children\":[\"$\",\"div\",null,{\"className\":\"grid-row grid-gap-lg\",\"children\":[[\"$\",\"div\",null,{\"className\":\"usa-banner__guidance tablet:grid-col-6\",\"children\":[[\"$\",\"$Le\",null,{\"className\":\"usa-banner__icon usa-media-block__img\",\"src\":{\"src\":\"/_next/static/media/icon-dot-gov.3e9cb1b5.svg\",\"height\":64,\"width\":64,\"blurWidth\":0,\"blurHeight\":0},\"role\":\"img\",\"alt\":\"\",\"aria-hidden\":\"true\",\"width\":\"40\",\"height\":\"40\"}],[\"$\",\"div\",null,{\"className\":\"usa-media-block__body\",\"children\":[\"$\",\"p\",null,{\"children\":[[\"$\",\"strong\",null,{\"children\":\"Official websites use .gov\"}],[\"$\",\"br\",null,{}],\"A \",[\"$\",\"strong\",null,{\"children\":\".gov\"}],\" website belongs to an official government organization in the United States.\"]}]}]]}],[\"$\",\"div\",null,{\"className\":\"usa-banner__guidance tablet:grid-col-6\",\"children\":[[\"$\",\"$Le\",null,{\"className\":\"usa-banner__icon usa-media-block__img\",\"src\":{\"src\":\"/_next/static/media/icon-https.e7f1a222.svg\",\"height\":64,\"width\":64,\"blurWidth\":0,\"blurHeight\":0},\"role\":\"img\",\"alt\":\"\",\"aria-hidden\":\"true\",\"width\":\"40\",\"height\":\"40\"}],[\"$\",\"div\",null,{\"className\":\"usa-media-block__body\",\"children\":[\"$\",\"p\",null,{\"children\":[[\"$\",\"strong\",null,{\"children\":\"Secure .gov websites use HTTPS\"}],[\"$\",\"br\",null,{}],\"A \",[\"$\",\"strong\",null,{\"children\":\"lock\"}],\" (\",[\"$\",\"span\",null,{\"className\":\"icon-lock\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":\"52\",\"height\":\"64\",\"viewBox\":\"0 0 52 64\",\"className\":\"usa-banner__lock-image\",\"role\":\"img\",\"aria-labelledby\":\"banner-lock-description-default\",\"focusable\":\"false\",\"children\":[[\"$\",\"title\",null,{\"id\":\"banner-lock-title-default\",\"children\":\"Lock\"}],[\"$\",\"desc\",null,{\"id\":\"banner-lock-description-default\",\"children\":\"Locked padlock icon\"}],[\"$\",\"path\",null,{\"fill\":\"#000000\",\"fillRule\":\"evenodd\",\"d\":\"M26 0c10.493 0 19 8.507 19 19v9h3a4 4 0 0 1 4 4v28a4 4 0 0 1-4 4H4a4 4 0 0 1-4-4V32a4 4 0 0 1 4-4h3v-9C7 8.507 15.507 0 26 0zm0 8c-5.979 0-10.843 4.77-10.996 10.712L15 19v9h22v-9c0-6.075-4.925-11-11-11z\"}]]}]}],\") or \",[\"$\",\"strong\",null,{\"children\":\"https://\"}],\" means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.\"]}]}]]}]]}]}]]}]}]],[\"$\",\"$Lf\",null,{\"value\":\"$10\",\"children\":[[\"$\",\"div\",null,{\"className\":\"usa-overlay\"}],[\"$\",\"header\",null,{\"className\":\"usa-header usa-header--extended\",\"children\":[[\"$\",\"div\",null,{\"className\":\"bg-primary-dark\",\"children\":[\"$\",\"div\",null,{\"className\":\"usa-navbar\",\"children\":[[\"$\",\"div\",null,{\"className\":\"usa-logo padding-y-4 padding-right-3\",\"id\":\"CyberGeek-logo\",\"children\":[\"$\",\"$L11\",null,{\"href\":\"/\",\"title\":\"CMS CyberGeek Home\",\"children\":[\"$\",\"$Le\",null,{\"src\":{\"src\":\"/_next/static/media/CyberGeek-logo.8e9bbd2b.svg\",\"height\":50,\"width\":425,\"blurWidth\":0,\"blurHeight\":0},\"alt\":\"CyberGeek logo\",\"width\":\"298\",\"height\":\"35\",\"priority\":true}]}]}],[\"$\",\"button\",null,{\"aria-label\":\"Open menu\",\"type\":\"button\",\"className\":\"usa-menu-btn\",\"data-cy\":\"menu-button\",\"children\":\"Menu\"}]]}]}],[\"$\",\"$L12\",null,{}]]}]]}],[\"$\",\"main\",null,{\"id\":\"main\",\"children\":[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L13\",null,{\"children\":[\"$\",\"$L8\",null,{}]}],\"templateStyles\":[],\"templateScripts\":[],\"notFound\":[\"$\",\"section\",null,{\"className\":\"hero hero--theme-content-not-found undefined\",\"children\":[[\"$\",\"$Le\",null,{\"alt\":\"404 page not found\",\"className\":\"hero__graphic\",\"priority\":true,\"src\":{\"src\":\"/_next/static/media/content-not-found-graphic.8f104f47.svg\",\"height\":551,\"width\":948,\"blurWidth\":0,\"blurHeight\":0}}],[\"$\",\"div\",null,{\"className\":\"maxw-widescreen margin-x-auto padding-x-2 desktop:padding-x-0 padding-top-4 padding-bottom-6 desktop:padding-y-7\",\"children\":[\"$\",\"div\",null,{\"className\":\"tablet:grid-container position-relative \",\"children\":[\"$\",\"div\",null,{\"className\":\"hero__row grid-row grid-gap\",\"children\":[[\"$\",\"div\",null,{\"className\":\"tablet:grid-col-5 widescreen:position-relative\",\"children\":[false,false]}],[\"$\",\"div\",null,{\"className\":\"hero__column tablet:grid-col-7 flow padding-bottom-2\",\"children\":[\"$undefined\",\"$undefined\",false,[\"$\",\"h1\",null,{\"className\":\"hero__heading margin-0 line-height-sans-3 desktop:line-height-sans-2\",\"children\":\"We can't find that page.\"}],\"$undefined\",\"$undefined\",false,[\"$\",\"div\",null,{\"children\":[[\"$\",\"div\",null,{\"className\":\"hero__description\",\"children\":[[\"The page you're looking for may have been moved or retired. You can\",\" \",[\"$\",\"$L11\",null,{\"href\":\"/\",\"children\":\"visit our home page\"}],\" or use the search box to find helpful resources.\"]]}],[\"$\",\"div\",null,{\"className\":\"margin-top-6 search-container\",\"children\":[\"$\",\"$L14\",null,{\"theme\":\"content-not-found\"}]}]]}],false]}],false,false]}]}]}]]}],\"notFoundStyles\":[]}]}],[\"$\",\"$L15\",null,{}],[\"$\",\"$L16\",null,{}],[\"$\",\"$Ld\",null,{\"src\":\"/assets/javascript/uswds.min.js\",\"strategy\":\"beforeInteractive\"}]]}]]}]\n"])</script><script>self.__next_f.push([1,"17:I[9461,[\"866\",\"static/chunks/e37a0b60-b74be3d42787b18d.js\",\"30\",\"static/chunks/30-49b1c1429d73281d.js\",\"317\",\"static/chunks/317-0f87feacc1712b2f.js\",\"904\",\"static/chunks/904-dbddf7494c3e6975.js\",\"972\",\"static/chunks/972-6e520d137ef194fb.js\",\"549\",\"static/chunks/549-c87c1c3bbacc319f.js\",\"192\",\"static/chunks/app/learn/%5Bslug%5D/page-5b91cdc45a95ebbe.js\"],\"default\"]\n18:T1d14,"])</script><script>self.__next_f.push([1,"\u003cp\u003eFor definitions of cybersecurity and privacy terms, we use the online glossary provided by the National Institute of Standards and Technology (NIST). \u003ca href=\"https://csrc.nist.gov/glossary?index=A\"\u003eVisit the NIST glossary here\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eFor CMS security and privacy acronyms, see the list below.\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eA - C\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eAC - Access Control\u003c/p\u003e\u003cp\u003eADO - Application Development Organization\u003c/p\u003e\u003cp\u003eAO - Authorizing Official\u003c/p\u003e\u003cp\u003eARS\u0026nbsp; - Acceptable Risk Safeguards\u003c/p\u003e\u003cp\u003eASFR\u0026nbsp; - Assistant Secretary for Financial Resources\u003c/p\u003e\u003cp\u003eATO - Authority to Operate\u003c/p\u003e\u003cp\u003eAT - Awareness and Training\u003c/p\u003e\u003cp\u003eAU - Audit and Accountability\u003c/p\u003e\u003cp\u003eAV - Anti-Virus\u003c/p\u003e\u003cp\u003eBAA -\u0026nbsp; Business Associate Agreement\u003c/p\u003e\u003cp\u003eBAT -\u0026nbsp; Breach Analysis Team\u003c/p\u003e\u003cp\u003eBOD\u0026nbsp; - Binding Operational Directive\u003c/p\u003e\u003cp\u003eCA -\u0026nbsp; Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eCAO -\u0026nbsp; Chief Acquisition Officer\u003c/p\u003e\u003cp\u003eCCB -\u0026nbsp; Change Control Board\u003c/p\u003e\u003cp\u003eCCIC -\u0026nbsp; CMS Cybersecurity Integration Center\u003c/p\u003e\u003cp\u003eCDM -\u0026nbsp; Continuous Diagnostics and Mitigation\u003c/p\u003e\u003cp\u003eCDO -\u0026nbsp; Chief Data Officer\u003c/p\u003e\u003cp\u003eCFACTS\u0026nbsp; - CMS FISMA Continuous Tracking System\u003c/p\u003e\u003cp\u003eCFO\u0026nbsp; - Chief Financial Officer\u003c/p\u003e\u003cp\u003eCFR - Code of Federal Regulations\u003c/p\u003e\u003cp\u003eCHIP\u0026nbsp; - Children’s Health Insurance Program\u003c/p\u003e\u003cp\u003eCIO\u0026nbsp; - Chief Information Officer\u003c/p\u003e\u003cp\u003eCISO - Chief Information Security Officer\u003c/p\u003e\u003cp\u003eCLD - Cloud Computing\u003c/p\u003e\u003cp\u003eCMS IS2P2\u0026nbsp; - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eCM - Configuration Management\u003c/p\u003e\u003cp\u003eCMA - Computer Matching Agreements\u003c/p\u003e\u003cp\u003eCMS - Centers for Medicare \u0026amp; Medicaid Services\u003c/p\u003e\u003cp\u003eCMS CLD - CMS Cloud Computing\u003c/p\u003e\u003cp\u003eCO - Contracting Officer\u003c/p\u003e\u003cp\u003eCOO - Chief Operating Officer\u003c/p\u003e\u003cp\u003eCOOP - Continuity of Operations\u003c/p\u003e\u003cp\u003eCOR - Contracting Officer’s Representative\u003c/p\u003e\u003cp\u003eCP - Contingency Planning\u003c/p\u003e\u003cp\u003eCPIC - Capital Planning and Investment Control\u003c/p\u003e\u003cp\u003eCRA - Cyber Risk Advisor\u003c/p\u003e\u003cp\u003eCTO - Chief Technology Officer\u003c/p\u003e\u003cp\u003eCSIRC - Computer Security Incident Response Center\u003c/p\u003e\u003cp\u003eCSP - Cloud Service Provider\u003c/p\u003e\u003cp\u003eCSRAP - Cybersecurity Risk Assessment Program\u003c/p\u003e\u003cp\u003eCTI - Cyber Threat Intelligence\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eD - I\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eDGB - Data Governance Board\u003c/p\u003e\u003cp\u003eDHS - Department of Homeland Security\u003c/p\u003e\u003cp\u003eDI - Data Quality and Integrity\u003c/p\u003e\u003cp\u003eDIB - Data Integrity Board\u003c/p\u003e\u003cp\u003eDoD - Department of Defense\u003c/p\u003e\u003cp\u003eDSI - Physical Security and Strategic Information\u003c/p\u003e\u003cp\u003eDUA - Data Use Agreement\u003c/p\u003e\u003cp\u003eEA - Enterprise Architecture\u003c/p\u003e\u003cp\u003eEPLC - Enterprise Performance Life Cycle\u003c/p\u003e\u003cp\u003eE.O. - Executive Order\u003c/p\u003e\u003cp\u003eEOD - Entry on Duty\u003c/p\u003e\u003cp\u003eFedRAMP - Federal Risk and Authorization Management Program\u003c/p\u003e\u003cp\u003eFIPP - Fair Information Practice Principles\u003c/p\u003e\u003cp\u003eFIPS - Federal Information Processing Standard\u003c/p\u003e\u003cp\u003eFISCAM - Federal Information Systems Controls Audit Manual\u003c/p\u003e\u003cp\u003eFISMA - Federal Information Security Modernization Act of 2014\u003c/p\u003e\u003cp\u003eFOIA - Freedom of Information Act\u003c/p\u003e\u003cp\u003eFTI - Federal Tax Information\u003c/p\u003e\u003cp\u003eGAO - Government Accountability Office\u003c/p\u003e\u003cp\u003eHHS - Department of Health and Human Services\u003c/p\u003e\u003cp\u003eHHSAR - Health and Human Services Acquisition Regulation\u003c/p\u003e\u003cp\u003eHIDS - Host-Based Intrusion Detection System\u003c/p\u003e\u003cp\u003eHIM - Health Insurance Marketplace\u003c/p\u003e\u003cp\u003eHIPAA - Health Insurance Portability and Accountability Act of 1996\u003c/p\u003e\u003cp\u003eHITECH - Health Information Technology for Economic and Clinical Health\u003c/p\u003e\u003cp\u003eHSTS - HTTP Strict Transport Security\u003c/p\u003e\u003cp\u003eHTTP - Hypertext Transport Protocol\u003c/p\u003e\u003cp\u003eHVA - High Value Asset\u003c/p\u003e\u003cp\u003eIA - Identification and Authentication\u003c/p\u003e\u003cp\u003eIEC - International Electro Technical Commission\u003c/p\u003e\u003cp\u003eIOC - Indicators of Compromise\u003c/p\u003e\u003cp\u003eIP - Individual Participation and Redress\u003c/p\u003e\u003cp\u003eIR - Incident Response\u003c/p\u003e\u003cp\u003eIRS - Internal Revenue Service\u003c/p\u003e\u003cp\u003eIRT - Incident Response Team\u003c/p\u003e\u003cp\u003eIS2P - HHS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eIS2P2 - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eISA - Information Sharing Agreement\u003c/p\u003e\u003cp\u003eISCM - Information Security Continuous Monitoring\u003c/p\u003e\u003cp\u003eISCP - Information System Contingency Plan\u003c/p\u003e\u003cp\u003eISO - Information System Owner, Information Security Officer, International Standards Organization\u003c/p\u003e\u003cp\u003eISPG - Information Security and Privacy Group\u003c/p\u003e\u003cp\u003eISRA - Information Security Risk Assessment\u003c/p\u003e\u003cp\u003eISSO - Information System Security Officer\u003c/p\u003e\u003cp\u003eISSOaas - ISSO As A Service\u003c/p\u003e\u003cp\u003eISSOCS - ISSO Contractor Support\u003c/p\u003e\u003cp\u003eIT - Information Technology\u003c/p\u003e\u003cp\u003eITIRB - IT Investment Review Board\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eJ - P\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eLDS - Limited Data Set\u003c/p\u003e\u003cp\u003eMA - Maintenance\u003c/p\u003e\u003cp\u003eMOA - Memorandum of Agreement\u003c/p\u003e\u003cp\u003eMOU - Memorandum of Understanding\u003c/p\u003e\u003cp\u003eMP - Media Protection\u003c/p\u003e\u003cp\u003eMTD - Maximum Tolerable Downtime\u003c/p\u003e\u003cp\u003eNARA - National Archives and Records Administration\u003c/p\u003e\u003cp\u003eNICE - National Initiative for Cybersecurity Education\u003c/p\u003e\u003cp\u003eNIST - National Institute of Standards and Technology\u003c/p\u003e\u003cp\u003eNSA - National Security Agency\u003c/p\u003e\u003cp\u003eNSL - National Security Letter\u003c/p\u003e\u003cp\u003eO\u0026amp;M - Operations and Maintenance\u003c/p\u003e\u003cp\u003eOA - Office of the Administrator\u003c/p\u003e\u003cp\u003eOAGM - Office of Accounts and Grants Management\u003c/p\u003e\u003cp\u003eOE - Operations Executive\u003c/p\u003e\u003cp\u003eOEDA - Office of Enterprise Data and Analytics\u003c/p\u003e\u003cp\u003eOGAPA - Office of Grants and Acquisition Policy and Accountability\u003c/p\u003e\u003cp\u003eOGC - Office of General Counsel\u003c/p\u003e\u003cp\u003eOIG - Office of the Inspector General\u003c/p\u003e\u003cp\u003eOIT - Office of Information Technology\u003c/p\u003e\u003cp\u003eOMB - Office of Management and Budget\u003c/p\u003e\u003cp\u003eOPDIV - Operating Division\u003c/p\u003e\u003cp\u003eOSSI - Office of Security and Strategic Information\u003c/p\u003e\u003cp\u003ePE - Physical and Environmental Protection\u003c/p\u003e\u003cp\u003ePHI - Protected Health Information\u003c/p\u003e\u003cp\u003ePIA - Privacy Impact Assessment\u003c/p\u003e\u003cp\u003ePII - Personally Identifiable Information\u003c/p\u003e\u003cp\u003ePIRT - Privacy Incident Response Team\u003c/p\u003e\u003cp\u003ePIV - Personal Identity Verification\u003c/p\u003e\u003cp\u003ePL - Planning\u003c/p\u003e\u003cp\u003ePM - Program Management\u003c/p\u003e\u003cp\u003ePMO - Program Management Office\u003c/p\u003e\u003cp\u003ePOA\u0026amp;M - Plan of Action and Milestones\u003c/p\u003e\u003cp\u003ePOC - Point of Contact\u003c/p\u003e\u003cp\u003ePPSO - Personnel and Physical Security Officer\u003c/p\u003e\u003cp\u003ePS - Personnel Security\u003c/p\u003e\u003cp\u003ePSME - Privacy Subject Matter Expert\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eR - Z\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eRA - Risk Assessment\u003c/p\u003e\u003cp\u003eRBT - Role-Based Training\u003c/p\u003e\u003cp\u003eRMF - Risk Management Framework\u003c/p\u003e\u003cp\u003eRMH - Risk Management Handbook (this is \u003ca href=\"https://security.cms.gov/posts/ispg-will-transition-away-using-risk-management-handbook\"\u003ebeing retired\u003c/a\u003e)\u003c/p\u003e\u003cp\u003eRoB - Rules of Behavior\u003c/p\u003e\u003cp\u003eRPO - Recovery Point Objective\u003c/p\u003e\u003cp\u003eRTO - Recovery Time Objective\u003c/p\u003e\u003cp\u003eSA - System and Services Acquisition\u003c/p\u003e\u003cp\u003eSA\u0026amp;A - Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eSA\u0026amp;E - Security Architecture and Engineering\u003c/p\u003e\u003cp\u003eSC - System and Communications Protection\u003c/p\u003e\u003cp\u003eSCRM - Supply Chain Risk Management\u003c/p\u003e\u003cp\u003eSDLC - System Development Life Cycle\u003c/p\u003e\u003cp\u003eSE - Security\u003c/p\u003e\u003cp\u003eSES - Senior Executive Service\u003c/p\u003e\u003cp\u003eSI - System and Information Integrity\u003c/p\u003e\u003cp\u003eSIA - Security Impact Analysis\u003c/p\u003e\u003cp\u003eSOC - Security Operations Center\u003c/p\u003e\u003cp\u003eSOP - Senior Official for Privacy, Standard Operating Procedure\u003c/p\u003e\u003cp\u003eSOR - System of Records\u003c/p\u003e\u003cp\u003eSORN - System of Records Notice\u003c/p\u003e\u003cp\u003eSOW - Statement of Work\u003c/p\u003e\u003cp\u003eSP - Special Publication\u003c/p\u003e\u003cp\u003eSPMC - Strategic Planning Management Council\u003c/p\u003e\u003cp\u003eSSPP - System Security and Privacy Plan\u003c/p\u003e\u003cp\u003eSSR - Significant Security Responsibilities\u003c/p\u003e\u003cp\u003eTLS - Transport Layer Security\u003c/p\u003e\u003cp\u003eTR - Transparency\u003c/p\u003e\u003cp\u003eTRB - Technical Review Board\u003c/p\u003e\u003cp\u003eTRA - Technical Reference Architecture\u003c/p\u003e\u003cp\u003eUL - Use Limitation\u003c/p\u003e\u003cp\u003eUSC - United States Code\u003c/p\u003e"])</script><script>self.__next_f.push([1,"19:T1d14,"])</script><script>self.__next_f.push([1,"\u003cp\u003eFor definitions of cybersecurity and privacy terms, we use the online glossary provided by the National Institute of Standards and Technology (NIST). \u003ca href=\"https://csrc.nist.gov/glossary?index=A\"\u003eVisit the NIST glossary here\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eFor CMS security and privacy acronyms, see the list below.\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eA - C\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eAC - Access Control\u003c/p\u003e\u003cp\u003eADO - Application Development Organization\u003c/p\u003e\u003cp\u003eAO - Authorizing Official\u003c/p\u003e\u003cp\u003eARS\u0026nbsp; - Acceptable Risk Safeguards\u003c/p\u003e\u003cp\u003eASFR\u0026nbsp; - Assistant Secretary for Financial Resources\u003c/p\u003e\u003cp\u003eATO - Authority to Operate\u003c/p\u003e\u003cp\u003eAT - Awareness and Training\u003c/p\u003e\u003cp\u003eAU - Audit and Accountability\u003c/p\u003e\u003cp\u003eAV - Anti-Virus\u003c/p\u003e\u003cp\u003eBAA -\u0026nbsp; Business Associate Agreement\u003c/p\u003e\u003cp\u003eBAT -\u0026nbsp; Breach Analysis Team\u003c/p\u003e\u003cp\u003eBOD\u0026nbsp; - Binding Operational Directive\u003c/p\u003e\u003cp\u003eCA -\u0026nbsp; Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eCAO -\u0026nbsp; Chief Acquisition Officer\u003c/p\u003e\u003cp\u003eCCB -\u0026nbsp; Change Control Board\u003c/p\u003e\u003cp\u003eCCIC -\u0026nbsp; CMS Cybersecurity Integration Center\u003c/p\u003e\u003cp\u003eCDM -\u0026nbsp; Continuous Diagnostics and Mitigation\u003c/p\u003e\u003cp\u003eCDO -\u0026nbsp; Chief Data Officer\u003c/p\u003e\u003cp\u003eCFACTS\u0026nbsp; - CMS FISMA Continuous Tracking System\u003c/p\u003e\u003cp\u003eCFO\u0026nbsp; - Chief Financial Officer\u003c/p\u003e\u003cp\u003eCFR - Code of Federal Regulations\u003c/p\u003e\u003cp\u003eCHIP\u0026nbsp; - Children’s Health Insurance Program\u003c/p\u003e\u003cp\u003eCIO\u0026nbsp; - Chief Information Officer\u003c/p\u003e\u003cp\u003eCISO - Chief Information Security Officer\u003c/p\u003e\u003cp\u003eCLD - Cloud Computing\u003c/p\u003e\u003cp\u003eCMS IS2P2\u0026nbsp; - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eCM - Configuration Management\u003c/p\u003e\u003cp\u003eCMA - Computer Matching Agreements\u003c/p\u003e\u003cp\u003eCMS - Centers for Medicare \u0026amp; Medicaid Services\u003c/p\u003e\u003cp\u003eCMS CLD - CMS Cloud Computing\u003c/p\u003e\u003cp\u003eCO - Contracting Officer\u003c/p\u003e\u003cp\u003eCOO - Chief Operating Officer\u003c/p\u003e\u003cp\u003eCOOP - Continuity of Operations\u003c/p\u003e\u003cp\u003eCOR - Contracting Officer’s Representative\u003c/p\u003e\u003cp\u003eCP - Contingency Planning\u003c/p\u003e\u003cp\u003eCPIC - Capital Planning and Investment Control\u003c/p\u003e\u003cp\u003eCRA - Cyber Risk Advisor\u003c/p\u003e\u003cp\u003eCTO - Chief Technology Officer\u003c/p\u003e\u003cp\u003eCSIRC - Computer Security Incident Response Center\u003c/p\u003e\u003cp\u003eCSP - Cloud Service Provider\u003c/p\u003e\u003cp\u003eCSRAP - Cybersecurity Risk Assessment Program\u003c/p\u003e\u003cp\u003eCTI - Cyber Threat Intelligence\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eD - I\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eDGB - Data Governance Board\u003c/p\u003e\u003cp\u003eDHS - Department of Homeland Security\u003c/p\u003e\u003cp\u003eDI - Data Quality and Integrity\u003c/p\u003e\u003cp\u003eDIB - Data Integrity Board\u003c/p\u003e\u003cp\u003eDoD - Department of Defense\u003c/p\u003e\u003cp\u003eDSI - Physical Security and Strategic Information\u003c/p\u003e\u003cp\u003eDUA - Data Use Agreement\u003c/p\u003e\u003cp\u003eEA - Enterprise Architecture\u003c/p\u003e\u003cp\u003eEPLC - Enterprise Performance Life Cycle\u003c/p\u003e\u003cp\u003eE.O. - Executive Order\u003c/p\u003e\u003cp\u003eEOD - Entry on Duty\u003c/p\u003e\u003cp\u003eFedRAMP - Federal Risk and Authorization Management Program\u003c/p\u003e\u003cp\u003eFIPP - Fair Information Practice Principles\u003c/p\u003e\u003cp\u003eFIPS - Federal Information Processing Standard\u003c/p\u003e\u003cp\u003eFISCAM - Federal Information Systems Controls Audit Manual\u003c/p\u003e\u003cp\u003eFISMA - Federal Information Security Modernization Act of 2014\u003c/p\u003e\u003cp\u003eFOIA - Freedom of Information Act\u003c/p\u003e\u003cp\u003eFTI - Federal Tax Information\u003c/p\u003e\u003cp\u003eGAO - Government Accountability Office\u003c/p\u003e\u003cp\u003eHHS - Department of Health and Human Services\u003c/p\u003e\u003cp\u003eHHSAR - Health and Human Services Acquisition Regulation\u003c/p\u003e\u003cp\u003eHIDS - Host-Based Intrusion Detection System\u003c/p\u003e\u003cp\u003eHIM - Health Insurance Marketplace\u003c/p\u003e\u003cp\u003eHIPAA - Health Insurance Portability and Accountability Act of 1996\u003c/p\u003e\u003cp\u003eHITECH - Health Information Technology for Economic and Clinical Health\u003c/p\u003e\u003cp\u003eHSTS - HTTP Strict Transport Security\u003c/p\u003e\u003cp\u003eHTTP - Hypertext Transport Protocol\u003c/p\u003e\u003cp\u003eHVA - High Value Asset\u003c/p\u003e\u003cp\u003eIA - Identification and Authentication\u003c/p\u003e\u003cp\u003eIEC - International Electro Technical Commission\u003c/p\u003e\u003cp\u003eIOC - Indicators of Compromise\u003c/p\u003e\u003cp\u003eIP - Individual Participation and Redress\u003c/p\u003e\u003cp\u003eIR - Incident Response\u003c/p\u003e\u003cp\u003eIRS - Internal Revenue Service\u003c/p\u003e\u003cp\u003eIRT - Incident Response Team\u003c/p\u003e\u003cp\u003eIS2P - HHS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eIS2P2 - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eISA - Information Sharing Agreement\u003c/p\u003e\u003cp\u003eISCM - Information Security Continuous Monitoring\u003c/p\u003e\u003cp\u003eISCP - Information System Contingency Plan\u003c/p\u003e\u003cp\u003eISO - Information System Owner, Information Security Officer, International Standards Organization\u003c/p\u003e\u003cp\u003eISPG - Information Security and Privacy Group\u003c/p\u003e\u003cp\u003eISRA - Information Security Risk Assessment\u003c/p\u003e\u003cp\u003eISSO - Information System Security Officer\u003c/p\u003e\u003cp\u003eISSOaas - ISSO As A Service\u003c/p\u003e\u003cp\u003eISSOCS - ISSO Contractor Support\u003c/p\u003e\u003cp\u003eIT - Information Technology\u003c/p\u003e\u003cp\u003eITIRB - IT Investment Review Board\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eJ - P\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eLDS - Limited Data Set\u003c/p\u003e\u003cp\u003eMA - Maintenance\u003c/p\u003e\u003cp\u003eMOA - Memorandum of Agreement\u003c/p\u003e\u003cp\u003eMOU - Memorandum of Understanding\u003c/p\u003e\u003cp\u003eMP - Media Protection\u003c/p\u003e\u003cp\u003eMTD - Maximum Tolerable Downtime\u003c/p\u003e\u003cp\u003eNARA - National Archives and Records Administration\u003c/p\u003e\u003cp\u003eNICE - National Initiative for Cybersecurity Education\u003c/p\u003e\u003cp\u003eNIST - National Institute of Standards and Technology\u003c/p\u003e\u003cp\u003eNSA - National Security Agency\u003c/p\u003e\u003cp\u003eNSL - National Security Letter\u003c/p\u003e\u003cp\u003eO\u0026amp;M - Operations and Maintenance\u003c/p\u003e\u003cp\u003eOA - Office of the Administrator\u003c/p\u003e\u003cp\u003eOAGM - Office of Accounts and Grants Management\u003c/p\u003e\u003cp\u003eOE - Operations Executive\u003c/p\u003e\u003cp\u003eOEDA - Office of Enterprise Data and Analytics\u003c/p\u003e\u003cp\u003eOGAPA - Office of Grants and Acquisition Policy and Accountability\u003c/p\u003e\u003cp\u003eOGC - Office of General Counsel\u003c/p\u003e\u003cp\u003eOIG - Office of the Inspector General\u003c/p\u003e\u003cp\u003eOIT - Office of Information Technology\u003c/p\u003e\u003cp\u003eOMB - Office of Management and Budget\u003c/p\u003e\u003cp\u003eOPDIV - Operating Division\u003c/p\u003e\u003cp\u003eOSSI - Office of Security and Strategic Information\u003c/p\u003e\u003cp\u003ePE - Physical and Environmental Protection\u003c/p\u003e\u003cp\u003ePHI - Protected Health Information\u003c/p\u003e\u003cp\u003ePIA - Privacy Impact Assessment\u003c/p\u003e\u003cp\u003ePII - Personally Identifiable Information\u003c/p\u003e\u003cp\u003ePIRT - Privacy Incident Response Team\u003c/p\u003e\u003cp\u003ePIV - Personal Identity Verification\u003c/p\u003e\u003cp\u003ePL - Planning\u003c/p\u003e\u003cp\u003ePM - Program Management\u003c/p\u003e\u003cp\u003ePMO - Program Management Office\u003c/p\u003e\u003cp\u003ePOA\u0026amp;M - Plan of Action and Milestones\u003c/p\u003e\u003cp\u003ePOC - Point of Contact\u003c/p\u003e\u003cp\u003ePPSO - Personnel and Physical Security Officer\u003c/p\u003e\u003cp\u003ePS - Personnel Security\u003c/p\u003e\u003cp\u003ePSME - Privacy Subject Matter Expert\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eR - Z\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eRA - Risk Assessment\u003c/p\u003e\u003cp\u003eRBT - Role-Based Training\u003c/p\u003e\u003cp\u003eRMF - Risk Management Framework\u003c/p\u003e\u003cp\u003eRMH - Risk Management Handbook (this is \u003ca href=\"https://security.cms.gov/posts/ispg-will-transition-away-using-risk-management-handbook\"\u003ebeing retired\u003c/a\u003e)\u003c/p\u003e\u003cp\u003eRoB - Rules of Behavior\u003c/p\u003e\u003cp\u003eRPO - Recovery Point Objective\u003c/p\u003e\u003cp\u003eRTO - Recovery Time Objective\u003c/p\u003e\u003cp\u003eSA - System and Services Acquisition\u003c/p\u003e\u003cp\u003eSA\u0026amp;A - Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eSA\u0026amp;E - Security Architecture and Engineering\u003c/p\u003e\u003cp\u003eSC - System and Communications Protection\u003c/p\u003e\u003cp\u003eSCRM - Supply Chain Risk Management\u003c/p\u003e\u003cp\u003eSDLC - System Development Life Cycle\u003c/p\u003e\u003cp\u003eSE - Security\u003c/p\u003e\u003cp\u003eSES - Senior Executive Service\u003c/p\u003e\u003cp\u003eSI - System and Information Integrity\u003c/p\u003e\u003cp\u003eSIA - Security Impact Analysis\u003c/p\u003e\u003cp\u003eSOC - Security Operations Center\u003c/p\u003e\u003cp\u003eSOP - Senior Official for Privacy, Standard Operating Procedure\u003c/p\u003e\u003cp\u003eSOR - System of Records\u003c/p\u003e\u003cp\u003eSORN - System of Records Notice\u003c/p\u003e\u003cp\u003eSOW - Statement of Work\u003c/p\u003e\u003cp\u003eSP - Special Publication\u003c/p\u003e\u003cp\u003eSPMC - Strategic Planning Management Council\u003c/p\u003e\u003cp\u003eSSPP - System Security and Privacy Plan\u003c/p\u003e\u003cp\u003eSSR - Significant Security Responsibilities\u003c/p\u003e\u003cp\u003eTLS - Transport Layer Security\u003c/p\u003e\u003cp\u003eTR - Transparency\u003c/p\u003e\u003cp\u003eTRB - Technical Review Board\u003c/p\u003e\u003cp\u003eTRA - Technical Reference Architecture\u003c/p\u003e\u003cp\u003eUL - Use Limitation\u003c/p\u003e\u003cp\u003eUSC - United States Code\u003c/p\u003e"])</script><script>self.__next_f.push([1,"1c:{\"href\":\"https://cybergeek.cms.gov/jsonapi/node_type/node_type/d185e460-4998-4d2b-85cb-b04f304dfb1b\"}\n1b:{\"self\":\"$1c\"}\n1f:[\"menu_ui\",\"scheduler\"]\n1e:{\"module\":\"$1f\"}\n22:[]\n21:{\"available_menus\":\"$22\",\"parent\":\"\"}\n23:{\"expand_fieldset\":\"when_required\",\"fields_display_mode\":\"vertical_tab\",\"publish_enable\":false,\"publish_past_date\":\"error\",\"publish_past_date_created\":false,\"publish_required\":false,\"publish_revision\":false,\"publish_touch\":false,\"show_message_after_update\":true,\"unpublish_enable\":false,\"unpublish_required\":false,\"unpublish_revision\":false}\n20:{\"menu_ui\":\"$21\",\"scheduler\":\"$23\"}\n1d:{\"langcode\":\"en\",\"status\":true,\"dependencies\":\"$1e\",\"third_party_settings\":\"$20\",\"name\":\"Explainer page\",\"drupal_internal__type\":\"explainer\",\"description\":\"Use \u003ci\u003eExplainer pages\u003c/i\u003e to provide general information in plain language about a policy, program, tool, service, or task related to security and privacy at CMS.\",\"help\":null,\"new_revision\":true,\"preview_mode\":1,\"display_submitted\":true}\n1a:{\"type\":\"node_type--node_type\",\"id\":\"d185e460-4998-4d2b-85cb-b04f304dfb1b\",\"links\":\"$1b\",\"attributes\":\"$1d\"}\n26:{\"href\":\"https://cybergeek.cms.gov/jsonapi/user/user/e352e203-fe9c-47ba-af75-2c7f8302fca8\"}\n25:{\"self\":\"$26\"}\n27:{\"display_name\":\"mburgess\"}\n24:{\"type\":\"user--user\",\"id\":\"e352e203-fe9c-47ba-af75-2c7f8302fca8\",\"links\":\"$25\",\"attributes\":\"$27\"}\n2a:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22?resourceVersion=id%3A131\"}\n29:{\"self\":\"$2a\"}\n2c:{\"alias\":null,\"pid\":null,\"langcode\":\"en\"}\n2b:{\"drupal_internal__tid\":131,\"drupal_internal__revision_id\":131,\"langcode\":\"en\",\"revision_created\":\"2022-08-02T23:13:33+00:00\",\"status\":true,\"name\":\"General Information\",\"description\":null,\"weight\":2,\"changed\":\"2023-03-10T19:04:03+00:00\",\"default_langcode\":true,\"revision_translation_affected\":true,\"path\":\"$2c\"}\n30:{\"drupal_internal__target_id\":\"resource_type\"}\n2f:{\"type\":\"taxonomy_vocabulary--taxonomy_vocabulary\",\"id\":\"3a0127c4-ee06-41ed-8239-f796f6d78eb3\",\"meta\":\"$30\"}\n32:{\"href\":\""])</script><script>self.__next_f.push([1,"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/vid?resourceVersion=id%3A131\"}\n33:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/relationships/vid?resourceVersion=id%3A131\"}\n31:{\"related\":\"$32\",\"self\":\"$33\"}\n2e:{\"data\":\"$2f\",\"links\":\"$31\"}\n36:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/revision_user?resourceVersion=id%3A131\"}\n37:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/relationships/revision_user?resourceVersion=id%3A131\"}\n35:{\"related\":\"$36\",\"self\":\"$37\"}\n34:{\"data\":null,\"links\":\"$35\"}\n3e:{\"about\":\"Usage and meaning of the 'virtual' resource identifier.\"}\n3d:{\"href\":\"https://www.drupal.org/docs/8/modules/json-api/core-concepts#virtual\",\"meta\":\"$3e\"}\n3c:{\"help\":\"$3d\"}\n3b:{\"links\":\"$3c\"}\n3a:{\"type\":\"taxonomy_term--resource_type\",\"id\":\"virtual\",\"meta\":\"$3b\"}\n39:[\"$3a\"]\n40:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/parent?resourceVersion=id%3A131\"}\n41:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/relationships/parent?resourceVersion=id%3A131\"}\n3f:{\"related\":\"$40\",\"self\":\"$41\"}\n38:{\"data\":\"$39\",\"links\":\"$3f\"}\n2d:{\"vid\":\"$2e\",\"revision_user\":\"$34\",\"parent\":\"$38\"}\n28:{\"type\":\"taxonomy_term--resource_type\",\"id\":\"a17f4908-9141-4b1e-82aa-e6bfe0f91a22\",\"links\":\"$29\",\"attributes\":\"$2b\",\"relationships\":\"$2d\"}\n44:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0?resourceVersion=id%3A16\"}\n43:{\"self\":\"$44\"}\n46:{\"alias\":null,\"pid\":null,\"langcode\":\"en\"}\n45:{\"drupal_internal__tid\":16,\"drupal_internal__revision_id\":16,\"langcode\":\"en\",\"revision_created\":\"2022-08-02T23:05:20+00:00\",\"status\":true,\"name\":\"CMS Policy \u0026 Guidance\",\"description\":null,\"weight\":2,\"changed\":\"2023-03-10T19:04:22+00:00\",\"default_langcode\":true,\"rev"])</script><script>self.__next_f.push([1,"ision_translation_affected\":true,\"path\":\"$46\"}\n4a:{\"drupal_internal__target_id\":\"topics\"}\n49:{\"type\":\"taxonomy_vocabulary--taxonomy_vocabulary\",\"id\":\"73f89dec-123f-4c8c-9a97-d025a2b0e5cf\",\"meta\":\"$4a\"}\n4c:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/vid?resourceVersion=id%3A16\"}\n4d:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/relationships/vid?resourceVersion=id%3A16\"}\n4b:{\"related\":\"$4c\",\"self\":\"$4d\"}\n48:{\"data\":\"$49\",\"links\":\"$4b\"}\n50:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/revision_user?resourceVersion=id%3A16\"}\n51:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/relationships/revision_user?resourceVersion=id%3A16\"}\n4f:{\"related\":\"$50\",\"self\":\"$51\"}\n4e:{\"data\":null,\"links\":\"$4f\"}\n58:{\"about\":\"Usage and meaning of the 'virtual' resource identifier.\"}\n57:{\"href\":\"https://www.drupal.org/docs/8/modules/json-api/core-concepts#virtual\",\"meta\":\"$58\"}\n56:{\"help\":\"$57\"}\n55:{\"links\":\"$56\"}\n54:{\"type\":\"taxonomy_term--topics\",\"id\":\"virtual\",\"meta\":\"$55\"}\n53:[\"$54\"]\n5a:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/parent?resourceVersion=id%3A16\"}\n5b:{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/relationships/parent?resourceVersion=id%3A16\"}\n59:{\"related\":\"$5a\",\"self\":\"$5b\"}\n52:{\"data\":\"$53\",\"links\":\"$59\"}\n47:{\"vid\":\"$48\",\"revision_user\":\"$4e\",\"parent\":\"$52\"}\n42:{\"type\":\"taxonomy_term--topics\",\"id\":\"c12221c3-2c7e-4eb0-903f-0470aad63bf0\",\"links\":\"$43\",\"attributes\":\"$45\",\"relationships\":\"$47\"}\n5e:{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2?resourceVersion=id%3A19293\"}\n5d:{\"self\":\"$5e\"}\n60:[]\n62:T1d14,"])</script><script>self.__next_f.push([1,"\u003cp\u003eFor definitions of cybersecurity and privacy terms, we use the online glossary provided by the National Institute of Standards and Technology (NIST). \u003ca href=\"https://csrc.nist.gov/glossary?index=A\"\u003eVisit the NIST glossary here\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eFor CMS security and privacy acronyms, see the list below.\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eA - C\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eAC - Access Control\u003c/p\u003e\u003cp\u003eADO - Application Development Organization\u003c/p\u003e\u003cp\u003eAO - Authorizing Official\u003c/p\u003e\u003cp\u003eARS\u0026nbsp; - Acceptable Risk Safeguards\u003c/p\u003e\u003cp\u003eASFR\u0026nbsp; - Assistant Secretary for Financial Resources\u003c/p\u003e\u003cp\u003eATO - Authority to Operate\u003c/p\u003e\u003cp\u003eAT - Awareness and Training\u003c/p\u003e\u003cp\u003eAU - Audit and Accountability\u003c/p\u003e\u003cp\u003eAV - Anti-Virus\u003c/p\u003e\u003cp\u003eBAA -\u0026nbsp; Business Associate Agreement\u003c/p\u003e\u003cp\u003eBAT -\u0026nbsp; Breach Analysis Team\u003c/p\u003e\u003cp\u003eBOD\u0026nbsp; - Binding Operational Directive\u003c/p\u003e\u003cp\u003eCA -\u0026nbsp; Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eCAO -\u0026nbsp; Chief Acquisition Officer\u003c/p\u003e\u003cp\u003eCCB -\u0026nbsp; Change Control Board\u003c/p\u003e\u003cp\u003eCCIC -\u0026nbsp; CMS Cybersecurity Integration Center\u003c/p\u003e\u003cp\u003eCDM -\u0026nbsp; Continuous Diagnostics and Mitigation\u003c/p\u003e\u003cp\u003eCDO -\u0026nbsp; Chief Data Officer\u003c/p\u003e\u003cp\u003eCFACTS\u0026nbsp; - CMS FISMA Continuous Tracking System\u003c/p\u003e\u003cp\u003eCFO\u0026nbsp; - Chief Financial Officer\u003c/p\u003e\u003cp\u003eCFR - Code of Federal Regulations\u003c/p\u003e\u003cp\u003eCHIP\u0026nbsp; - Children’s Health Insurance Program\u003c/p\u003e\u003cp\u003eCIO\u0026nbsp; - Chief Information Officer\u003c/p\u003e\u003cp\u003eCISO - Chief Information Security Officer\u003c/p\u003e\u003cp\u003eCLD - Cloud Computing\u003c/p\u003e\u003cp\u003eCMS IS2P2\u0026nbsp; - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eCM - Configuration Management\u003c/p\u003e\u003cp\u003eCMA - Computer Matching Agreements\u003c/p\u003e\u003cp\u003eCMS - Centers for Medicare \u0026amp; Medicaid Services\u003c/p\u003e\u003cp\u003eCMS CLD - CMS Cloud Computing\u003c/p\u003e\u003cp\u003eCO - Contracting Officer\u003c/p\u003e\u003cp\u003eCOO - Chief Operating Officer\u003c/p\u003e\u003cp\u003eCOOP - Continuity of Operations\u003c/p\u003e\u003cp\u003eCOR - Contracting Officer’s Representative\u003c/p\u003e\u003cp\u003eCP - Contingency Planning\u003c/p\u003e\u003cp\u003eCPIC - Capital Planning and Investment Control\u003c/p\u003e\u003cp\u003eCRA - Cyber Risk Advisor\u003c/p\u003e\u003cp\u003eCTO - Chief Technology Officer\u003c/p\u003e\u003cp\u003eCSIRC - Computer Security Incident Response Center\u003c/p\u003e\u003cp\u003eCSP - Cloud Service Provider\u003c/p\u003e\u003cp\u003eCSRAP - Cybersecurity Risk Assessment Program\u003c/p\u003e\u003cp\u003eCTI - Cyber Threat Intelligence\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eD - I\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eDGB - Data Governance Board\u003c/p\u003e\u003cp\u003eDHS - Department of Homeland Security\u003c/p\u003e\u003cp\u003eDI - Data Quality and Integrity\u003c/p\u003e\u003cp\u003eDIB - Data Integrity Board\u003c/p\u003e\u003cp\u003eDoD - Department of Defense\u003c/p\u003e\u003cp\u003eDSI - Physical Security and Strategic Information\u003c/p\u003e\u003cp\u003eDUA - Data Use Agreement\u003c/p\u003e\u003cp\u003eEA - Enterprise Architecture\u003c/p\u003e\u003cp\u003eEPLC - Enterprise Performance Life Cycle\u003c/p\u003e\u003cp\u003eE.O. - Executive Order\u003c/p\u003e\u003cp\u003eEOD - Entry on Duty\u003c/p\u003e\u003cp\u003eFedRAMP - Federal Risk and Authorization Management Program\u003c/p\u003e\u003cp\u003eFIPP - Fair Information Practice Principles\u003c/p\u003e\u003cp\u003eFIPS - Federal Information Processing Standard\u003c/p\u003e\u003cp\u003eFISCAM - Federal Information Systems Controls Audit Manual\u003c/p\u003e\u003cp\u003eFISMA - Federal Information Security Modernization Act of 2014\u003c/p\u003e\u003cp\u003eFOIA - Freedom of Information Act\u003c/p\u003e\u003cp\u003eFTI - Federal Tax Information\u003c/p\u003e\u003cp\u003eGAO - Government Accountability Office\u003c/p\u003e\u003cp\u003eHHS - Department of Health and Human Services\u003c/p\u003e\u003cp\u003eHHSAR - Health and Human Services Acquisition Regulation\u003c/p\u003e\u003cp\u003eHIDS - Host-Based Intrusion Detection System\u003c/p\u003e\u003cp\u003eHIM - Health Insurance Marketplace\u003c/p\u003e\u003cp\u003eHIPAA - Health Insurance Portability and Accountability Act of 1996\u003c/p\u003e\u003cp\u003eHITECH - Health Information Technology for Economic and Clinical Health\u003c/p\u003e\u003cp\u003eHSTS - HTTP Strict Transport Security\u003c/p\u003e\u003cp\u003eHTTP - Hypertext Transport Protocol\u003c/p\u003e\u003cp\u003eHVA - High Value Asset\u003c/p\u003e\u003cp\u003eIA - Identification and Authentication\u003c/p\u003e\u003cp\u003eIEC - International Electro Technical Commission\u003c/p\u003e\u003cp\u003eIOC - Indicators of Compromise\u003c/p\u003e\u003cp\u003eIP - Individual Participation and Redress\u003c/p\u003e\u003cp\u003eIR - Incident Response\u003c/p\u003e\u003cp\u003eIRS - Internal Revenue Service\u003c/p\u003e\u003cp\u003eIRT - Incident Response Team\u003c/p\u003e\u003cp\u003eIS2P - HHS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eIS2P2 - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eISA - Information Sharing Agreement\u003c/p\u003e\u003cp\u003eISCM - Information Security Continuous Monitoring\u003c/p\u003e\u003cp\u003eISCP - Information System Contingency Plan\u003c/p\u003e\u003cp\u003eISO - Information System Owner, Information Security Officer, International Standards Organization\u003c/p\u003e\u003cp\u003eISPG - Information Security and Privacy Group\u003c/p\u003e\u003cp\u003eISRA - Information Security Risk Assessment\u003c/p\u003e\u003cp\u003eISSO - Information System Security Officer\u003c/p\u003e\u003cp\u003eISSOaas - ISSO As A Service\u003c/p\u003e\u003cp\u003eISSOCS - ISSO Contractor Support\u003c/p\u003e\u003cp\u003eIT - Information Technology\u003c/p\u003e\u003cp\u003eITIRB - IT Investment Review Board\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eJ - P\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eLDS - Limited Data Set\u003c/p\u003e\u003cp\u003eMA - Maintenance\u003c/p\u003e\u003cp\u003eMOA - Memorandum of Agreement\u003c/p\u003e\u003cp\u003eMOU - Memorandum of Understanding\u003c/p\u003e\u003cp\u003eMP - Media Protection\u003c/p\u003e\u003cp\u003eMTD - Maximum Tolerable Downtime\u003c/p\u003e\u003cp\u003eNARA - National Archives and Records Administration\u003c/p\u003e\u003cp\u003eNICE - National Initiative for Cybersecurity Education\u003c/p\u003e\u003cp\u003eNIST - National Institute of Standards and Technology\u003c/p\u003e\u003cp\u003eNSA - National Security Agency\u003c/p\u003e\u003cp\u003eNSL - National Security Letter\u003c/p\u003e\u003cp\u003eO\u0026amp;M - Operations and Maintenance\u003c/p\u003e\u003cp\u003eOA - Office of the Administrator\u003c/p\u003e\u003cp\u003eOAGM - Office of Accounts and Grants Management\u003c/p\u003e\u003cp\u003eOE - Operations Executive\u003c/p\u003e\u003cp\u003eOEDA - Office of Enterprise Data and Analytics\u003c/p\u003e\u003cp\u003eOGAPA - Office of Grants and Acquisition Policy and Accountability\u003c/p\u003e\u003cp\u003eOGC - Office of General Counsel\u003c/p\u003e\u003cp\u003eOIG - Office of the Inspector General\u003c/p\u003e\u003cp\u003eOIT - Office of Information Technology\u003c/p\u003e\u003cp\u003eOMB - Office of Management and Budget\u003c/p\u003e\u003cp\u003eOPDIV - Operating Division\u003c/p\u003e\u003cp\u003eOSSI - Office of Security and Strategic Information\u003c/p\u003e\u003cp\u003ePE - Physical and Environmental Protection\u003c/p\u003e\u003cp\u003ePHI - Protected Health Information\u003c/p\u003e\u003cp\u003ePIA - Privacy Impact Assessment\u003c/p\u003e\u003cp\u003ePII - Personally Identifiable Information\u003c/p\u003e\u003cp\u003ePIRT - Privacy Incident Response Team\u003c/p\u003e\u003cp\u003ePIV - Personal Identity Verification\u003c/p\u003e\u003cp\u003ePL - Planning\u003c/p\u003e\u003cp\u003ePM - Program Management\u003c/p\u003e\u003cp\u003ePMO - Program Management Office\u003c/p\u003e\u003cp\u003ePOA\u0026amp;M - Plan of Action and Milestones\u003c/p\u003e\u003cp\u003ePOC - Point of Contact\u003c/p\u003e\u003cp\u003ePPSO - Personnel and Physical Security Officer\u003c/p\u003e\u003cp\u003ePS - Personnel Security\u003c/p\u003e\u003cp\u003ePSME - Privacy Subject Matter Expert\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eR - Z\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eRA - Risk Assessment\u003c/p\u003e\u003cp\u003eRBT - Role-Based Training\u003c/p\u003e\u003cp\u003eRMF - Risk Management Framework\u003c/p\u003e\u003cp\u003eRMH - Risk Management Handbook (this is \u003ca href=\"https://security.cms.gov/posts/ispg-will-transition-away-using-risk-management-handbook\"\u003ebeing retired\u003c/a\u003e)\u003c/p\u003e\u003cp\u003eRoB - Rules of Behavior\u003c/p\u003e\u003cp\u003eRPO - Recovery Point Objective\u003c/p\u003e\u003cp\u003eRTO - Recovery Time Objective\u003c/p\u003e\u003cp\u003eSA - System and Services Acquisition\u003c/p\u003e\u003cp\u003eSA\u0026amp;A - Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eSA\u0026amp;E - Security Architecture and Engineering\u003c/p\u003e\u003cp\u003eSC - System and Communications Protection\u003c/p\u003e\u003cp\u003eSCRM - Supply Chain Risk Management\u003c/p\u003e\u003cp\u003eSDLC - System Development Life Cycle\u003c/p\u003e\u003cp\u003eSE - Security\u003c/p\u003e\u003cp\u003eSES - Senior Executive Service\u003c/p\u003e\u003cp\u003eSI - System and Information Integrity\u003c/p\u003e\u003cp\u003eSIA - Security Impact Analysis\u003c/p\u003e\u003cp\u003eSOC - Security Operations Center\u003c/p\u003e\u003cp\u003eSOP - Senior Official for Privacy, Standard Operating Procedure\u003c/p\u003e\u003cp\u003eSOR - System of Records\u003c/p\u003e\u003cp\u003eSORN - System of Records Notice\u003c/p\u003e\u003cp\u003eSOW - Statement of Work\u003c/p\u003e\u003cp\u003eSP - Special Publication\u003c/p\u003e\u003cp\u003eSPMC - Strategic Planning Management Council\u003c/p\u003e\u003cp\u003eSSPP - System Security and Privacy Plan\u003c/p\u003e\u003cp\u003eSSR - Significant Security Responsibilities\u003c/p\u003e\u003cp\u003eTLS - Transport Layer Security\u003c/p\u003e\u003cp\u003eTR - Transparency\u003c/p\u003e\u003cp\u003eTRB - Technical Review Board\u003c/p\u003e\u003cp\u003eTRA - Technical Reference Architecture\u003c/p\u003e\u003cp\u003eUL - Use Limitation\u003c/p\u003e\u003cp\u003eUSC - United States Code\u003c/p\u003e"])</script><script>self.__next_f.push([1,"63:T1d14,"])</script><script>self.__next_f.push([1,"\u003cp\u003eFor definitions of cybersecurity and privacy terms, we use the online glossary provided by the National Institute of Standards and Technology (NIST). \u003ca href=\"https://csrc.nist.gov/glossary?index=A\"\u003eVisit the NIST glossary here\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eFor CMS security and privacy acronyms, see the list below.\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eA - C\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eAC - Access Control\u003c/p\u003e\u003cp\u003eADO - Application Development Organization\u003c/p\u003e\u003cp\u003eAO - Authorizing Official\u003c/p\u003e\u003cp\u003eARS\u0026nbsp; - Acceptable Risk Safeguards\u003c/p\u003e\u003cp\u003eASFR\u0026nbsp; - Assistant Secretary for Financial Resources\u003c/p\u003e\u003cp\u003eATO - Authority to Operate\u003c/p\u003e\u003cp\u003eAT - Awareness and Training\u003c/p\u003e\u003cp\u003eAU - Audit and Accountability\u003c/p\u003e\u003cp\u003eAV - Anti-Virus\u003c/p\u003e\u003cp\u003eBAA -\u0026nbsp; Business Associate Agreement\u003c/p\u003e\u003cp\u003eBAT -\u0026nbsp; Breach Analysis Team\u003c/p\u003e\u003cp\u003eBOD\u0026nbsp; - Binding Operational Directive\u003c/p\u003e\u003cp\u003eCA -\u0026nbsp; Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eCAO -\u0026nbsp; Chief Acquisition Officer\u003c/p\u003e\u003cp\u003eCCB -\u0026nbsp; Change Control Board\u003c/p\u003e\u003cp\u003eCCIC -\u0026nbsp; CMS Cybersecurity Integration Center\u003c/p\u003e\u003cp\u003eCDM -\u0026nbsp; Continuous Diagnostics and Mitigation\u003c/p\u003e\u003cp\u003eCDO -\u0026nbsp; Chief Data Officer\u003c/p\u003e\u003cp\u003eCFACTS\u0026nbsp; - CMS FISMA Continuous Tracking System\u003c/p\u003e\u003cp\u003eCFO\u0026nbsp; - Chief Financial Officer\u003c/p\u003e\u003cp\u003eCFR - Code of Federal Regulations\u003c/p\u003e\u003cp\u003eCHIP\u0026nbsp; - Children’s Health Insurance Program\u003c/p\u003e\u003cp\u003eCIO\u0026nbsp; - Chief Information Officer\u003c/p\u003e\u003cp\u003eCISO - Chief Information Security Officer\u003c/p\u003e\u003cp\u003eCLD - Cloud Computing\u003c/p\u003e\u003cp\u003eCMS IS2P2\u0026nbsp; - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eCM - Configuration Management\u003c/p\u003e\u003cp\u003eCMA - Computer Matching Agreements\u003c/p\u003e\u003cp\u003eCMS - Centers for Medicare \u0026amp; Medicaid Services\u003c/p\u003e\u003cp\u003eCMS CLD - CMS Cloud Computing\u003c/p\u003e\u003cp\u003eCO - Contracting Officer\u003c/p\u003e\u003cp\u003eCOO - Chief Operating Officer\u003c/p\u003e\u003cp\u003eCOOP - Continuity of Operations\u003c/p\u003e\u003cp\u003eCOR - Contracting Officer’s Representative\u003c/p\u003e\u003cp\u003eCP - Contingency Planning\u003c/p\u003e\u003cp\u003eCPIC - Capital Planning and Investment Control\u003c/p\u003e\u003cp\u003eCRA - Cyber Risk Advisor\u003c/p\u003e\u003cp\u003eCTO - Chief Technology Officer\u003c/p\u003e\u003cp\u003eCSIRC - Computer Security Incident Response Center\u003c/p\u003e\u003cp\u003eCSP - Cloud Service Provider\u003c/p\u003e\u003cp\u003eCSRAP - Cybersecurity Risk Assessment Program\u003c/p\u003e\u003cp\u003eCTI - Cyber Threat Intelligence\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eD - I\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eDGB - Data Governance Board\u003c/p\u003e\u003cp\u003eDHS - Department of Homeland Security\u003c/p\u003e\u003cp\u003eDI - Data Quality and Integrity\u003c/p\u003e\u003cp\u003eDIB - Data Integrity Board\u003c/p\u003e\u003cp\u003eDoD - Department of Defense\u003c/p\u003e\u003cp\u003eDSI - Physical Security and Strategic Information\u003c/p\u003e\u003cp\u003eDUA - Data Use Agreement\u003c/p\u003e\u003cp\u003eEA - Enterprise Architecture\u003c/p\u003e\u003cp\u003eEPLC - Enterprise Performance Life Cycle\u003c/p\u003e\u003cp\u003eE.O. - Executive Order\u003c/p\u003e\u003cp\u003eEOD - Entry on Duty\u003c/p\u003e\u003cp\u003eFedRAMP - Federal Risk and Authorization Management Program\u003c/p\u003e\u003cp\u003eFIPP - Fair Information Practice Principles\u003c/p\u003e\u003cp\u003eFIPS - Federal Information Processing Standard\u003c/p\u003e\u003cp\u003eFISCAM - Federal Information Systems Controls Audit Manual\u003c/p\u003e\u003cp\u003eFISMA - Federal Information Security Modernization Act of 2014\u003c/p\u003e\u003cp\u003eFOIA - Freedom of Information Act\u003c/p\u003e\u003cp\u003eFTI - Federal Tax Information\u003c/p\u003e\u003cp\u003eGAO - Government Accountability Office\u003c/p\u003e\u003cp\u003eHHS - Department of Health and Human Services\u003c/p\u003e\u003cp\u003eHHSAR - Health and Human Services Acquisition Regulation\u003c/p\u003e\u003cp\u003eHIDS - Host-Based Intrusion Detection System\u003c/p\u003e\u003cp\u003eHIM - Health Insurance Marketplace\u003c/p\u003e\u003cp\u003eHIPAA - Health Insurance Portability and Accountability Act of 1996\u003c/p\u003e\u003cp\u003eHITECH - Health Information Technology for Economic and Clinical Health\u003c/p\u003e\u003cp\u003eHSTS - HTTP Strict Transport Security\u003c/p\u003e\u003cp\u003eHTTP - Hypertext Transport Protocol\u003c/p\u003e\u003cp\u003eHVA - High Value Asset\u003c/p\u003e\u003cp\u003eIA - Identification and Authentication\u003c/p\u003e\u003cp\u003eIEC - International Electro Technical Commission\u003c/p\u003e\u003cp\u003eIOC - Indicators of Compromise\u003c/p\u003e\u003cp\u003eIP - Individual Participation and Redress\u003c/p\u003e\u003cp\u003eIR - Incident Response\u003c/p\u003e\u003cp\u003eIRS - Internal Revenue Service\u003c/p\u003e\u003cp\u003eIRT - Incident Response Team\u003c/p\u003e\u003cp\u003eIS2P - HHS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eIS2P2 - CMS Information Systems Security and Privacy Policy\u003c/p\u003e\u003cp\u003eISA - Information Sharing Agreement\u003c/p\u003e\u003cp\u003eISCM - Information Security Continuous Monitoring\u003c/p\u003e\u003cp\u003eISCP - Information System Contingency Plan\u003c/p\u003e\u003cp\u003eISO - Information System Owner, Information Security Officer, International Standards Organization\u003c/p\u003e\u003cp\u003eISPG - Information Security and Privacy Group\u003c/p\u003e\u003cp\u003eISRA - Information Security Risk Assessment\u003c/p\u003e\u003cp\u003eISSO - Information System Security Officer\u003c/p\u003e\u003cp\u003eISSOaas - ISSO As A Service\u003c/p\u003e\u003cp\u003eISSOCS - ISSO Contractor Support\u003c/p\u003e\u003cp\u003eIT - Information Technology\u003c/p\u003e\u003cp\u003eITIRB - IT Investment Review Board\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eJ - P\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eLDS - Limited Data Set\u003c/p\u003e\u003cp\u003eMA - Maintenance\u003c/p\u003e\u003cp\u003eMOA - Memorandum of Agreement\u003c/p\u003e\u003cp\u003eMOU - Memorandum of Understanding\u003c/p\u003e\u003cp\u003eMP - Media Protection\u003c/p\u003e\u003cp\u003eMTD - Maximum Tolerable Downtime\u003c/p\u003e\u003cp\u003eNARA - National Archives and Records Administration\u003c/p\u003e\u003cp\u003eNICE - National Initiative for Cybersecurity Education\u003c/p\u003e\u003cp\u003eNIST - National Institute of Standards and Technology\u003c/p\u003e\u003cp\u003eNSA - National Security Agency\u003c/p\u003e\u003cp\u003eNSL - National Security Letter\u003c/p\u003e\u003cp\u003eO\u0026amp;M - Operations and Maintenance\u003c/p\u003e\u003cp\u003eOA - Office of the Administrator\u003c/p\u003e\u003cp\u003eOAGM - Office of Accounts and Grants Management\u003c/p\u003e\u003cp\u003eOE - Operations Executive\u003c/p\u003e\u003cp\u003eOEDA - Office of Enterprise Data and Analytics\u003c/p\u003e\u003cp\u003eOGAPA - Office of Grants and Acquisition Policy and Accountability\u003c/p\u003e\u003cp\u003eOGC - Office of General Counsel\u003c/p\u003e\u003cp\u003eOIG - Office of the Inspector General\u003c/p\u003e\u003cp\u003eOIT - Office of Information Technology\u003c/p\u003e\u003cp\u003eOMB - Office of Management and Budget\u003c/p\u003e\u003cp\u003eOPDIV - Operating Division\u003c/p\u003e\u003cp\u003eOSSI - Office of Security and Strategic Information\u003c/p\u003e\u003cp\u003ePE - Physical and Environmental Protection\u003c/p\u003e\u003cp\u003ePHI - Protected Health Information\u003c/p\u003e\u003cp\u003ePIA - Privacy Impact Assessment\u003c/p\u003e\u003cp\u003ePII - Personally Identifiable Information\u003c/p\u003e\u003cp\u003ePIRT - Privacy Incident Response Team\u003c/p\u003e\u003cp\u003ePIV - Personal Identity Verification\u003c/p\u003e\u003cp\u003ePL - Planning\u003c/p\u003e\u003cp\u003ePM - Program Management\u003c/p\u003e\u003cp\u003ePMO - Program Management Office\u003c/p\u003e\u003cp\u003ePOA\u0026amp;M - Plan of Action and Milestones\u003c/p\u003e\u003cp\u003ePOC - Point of Contact\u003c/p\u003e\u003cp\u003ePPSO - Personnel and Physical Security Officer\u003c/p\u003e\u003cp\u003ePS - Personnel Security\u003c/p\u003e\u003cp\u003ePSME - Privacy Subject Matter Expert\u003c/p\u003e\u003ch2\u003e\u003cstrong\u003eR - Z\u003c/strong\u003e\u003c/h2\u003e\u003cp\u003eRA - Risk Assessment\u003c/p\u003e\u003cp\u003eRBT - Role-Based Training\u003c/p\u003e\u003cp\u003eRMF - Risk Management Framework\u003c/p\u003e\u003cp\u003eRMH - Risk Management Handbook (this is \u003ca href=\"https://security.cms.gov/posts/ispg-will-transition-away-using-risk-management-handbook\"\u003ebeing retired\u003c/a\u003e)\u003c/p\u003e\u003cp\u003eRoB - Rules of Behavior\u003c/p\u003e\u003cp\u003eRPO - Recovery Point Objective\u003c/p\u003e\u003cp\u003eRTO - Recovery Time Objective\u003c/p\u003e\u003cp\u003eSA - System and Services Acquisition\u003c/p\u003e\u003cp\u003eSA\u0026amp;A - Security Assessment and Authorization\u003c/p\u003e\u003cp\u003eSA\u0026amp;E - Security Architecture and Engineering\u003c/p\u003e\u003cp\u003eSC - System and Communications Protection\u003c/p\u003e\u003cp\u003eSCRM - Supply Chain Risk Management\u003c/p\u003e\u003cp\u003eSDLC - System Development Life Cycle\u003c/p\u003e\u003cp\u003eSE - Security\u003c/p\u003e\u003cp\u003eSES - Senior Executive Service\u003c/p\u003e\u003cp\u003eSI - System and Information Integrity\u003c/p\u003e\u003cp\u003eSIA - Security Impact Analysis\u003c/p\u003e\u003cp\u003eSOC - Security Operations Center\u003c/p\u003e\u003cp\u003eSOP - Senior Official for Privacy, Standard Operating Procedure\u003c/p\u003e\u003cp\u003eSOR - System of Records\u003c/p\u003e\u003cp\u003eSORN - System of Records Notice\u003c/p\u003e\u003cp\u003eSOW - Statement of Work\u003c/p\u003e\u003cp\u003eSP - Special Publication\u003c/p\u003e\u003cp\u003eSPMC - Strategic Planning Management Council\u003c/p\u003e\u003cp\u003eSSPP - System Security and Privacy Plan\u003c/p\u003e\u003cp\u003eSSR - Significant Security Responsibilities\u003c/p\u003e\u003cp\u003eTLS - Transport Layer Security\u003c/p\u003e\u003cp\u003eTR - Transparency\u003c/p\u003e\u003cp\u003eTRB - Technical Review Board\u003c/p\u003e\u003cp\u003eTRA - Technical Reference Architecture\u003c/p\u003e\u003cp\u003eUL - Use Limitation\u003c/p\u003e\u003cp\u003eUSC - United States Code\u003c/p\u003e"])</script><script>self.__next_f.push([1,"61:{\"value\":\"$62\",\"format\":\"body_text\",\"processed\":\"$63\"}\n5f:{\"drupal_internal__id\":441,\"drupal_internal__revision_id\":19293,\"langcode\":\"en\",\"status\":true,\"created\":\"2023-01-31T17:14:56+00:00\",\"parent_id\":\"636\",\"parent_type\":\"node\",\"parent_field_name\":\"field_page_section\",\"behavior_settings\":\"$60\",\"default_langcode\":true,\"revision_translation_affected\":true,\"field_text_block\":\"$61\"}\n67:{\"drupal_internal__target_id\":\"page_section\"}\n66:{\"type\":\"paragraphs_type--paragraphs_type\",\"id\":\"57f3f40a-8120-4393-b881-a5758f9fb30d\",\"meta\":\"$67\"}\n69:{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/paragraph_type?resourceVersion=id%3A19293\"}\n6a:{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/relationships/paragraph_type?resourceVersion=id%3A19293\"}\n68:{\"related\":\"$69\",\"self\":\"$6a\"}\n65:{\"data\":\"$66\",\"links\":\"$68\"}\n6d:{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/field_specialty_item?resourceVersion=id%3A19293\"}\n6e:{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/relationships/field_specialty_item?resourceVersion=id%3A19293\"}\n6c:{\"related\":\"$6d\",\"self\":\"$6e\"}\n6b:{\"data\":null,\"links\":\"$6c\"}\n64:{\"paragraph_type\":\"$65\",\"field_specialty_item\":\"$6b\"}\n5c:{\"type\":\"paragraph--page_section\",\"id\":\"1a9d7f2e-84fe-49ad-b231-b89232d84bd2\",\"links\":\"$5d\",\"attributes\":\"$5f\",\"relationships\":\"$64\"}\n"])</script><script>self.__next_f.push([1,"5:[\"$\",\"$L17\",null,{\"content\":{\"data\":{\"type\":\"node--explainer\",\"id\":\"a986c9d1-0084-453a-a099-a3d3228aca89\",\"links\":{\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89?resourceVersion=id%3A5903\"}},\"attributes\":{\"drupal_internal__nid\":636,\"drupal_internal__vid\":5903,\"langcode\":\"en\",\"revision_timestamp\":\"2024-09-10T19:39:49+00:00\",\"status\":true,\"title\":\"Acronyms\",\"created\":\"2023-01-31T15:17:00+00:00\",\"changed\":\"2024-09-10T19:39:49+00:00\",\"promote\":false,\"sticky\":false,\"default_langcode\":true,\"revision_translation_affected\":true,\"moderation_state\":\"published\",\"path\":{\"alias\":\"/learn/acronyms\",\"pid\":626,\"langcode\":\"en\"},\"rh_action\":null,\"rh_redirect\":null,\"rh_redirect_response\":null,\"rh_redirect_fallback_action\":null,\"publish_on\":null,\"unpublish_on\":null,\"body\":null,\"field_contact_email\":\"CISO@cms.hhs.gov\",\"field_contact_name\":\"ISPG Policy Team\",\"field_short_description\":{\"value\":\"Common security and privacy acronyms used at CMS\",\"format\":\"plain_text\",\"processed\":\"\u003cp\u003eCommon security and privacy acronyms used at CMS\u003c/p\u003e\\n\"},\"field_slack_channel\":[\"#ispg-sec_privacy-policy\"]},\"relationships\":{\"node_type\":{\"data\":{\"type\":\"node_type--node_type\",\"id\":\"d185e460-4998-4d2b-85cb-b04f304dfb1b\",\"meta\":{\"drupal_internal__target_id\":\"explainer\"}},\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/node_type?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/node_type?resourceVersion=id%3A5903\"}}},\"revision_uid\":{\"data\":{\"type\":\"user--user\",\"id\":\"e352e203-fe9c-47ba-af75-2c7f8302fca8\",\"meta\":{\"drupal_internal__target_id\":6}},\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/revision_uid?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/revision_uid?resourceVersion=id%3A5903\"}}},\"uid\":{\"data\":{\"type\":\"user--user\",\"id\":\"e352e203-fe9c-47ba-af75-2c7f8302fca8\",\"meta\":{\"drupal_internal__target_id\":6}},\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/uid?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/uid?resourceVersion=id%3A5903\"}}},\"field_page_section\":{\"data\":[{\"type\":\"paragraph--page_section\",\"id\":\"1a9d7f2e-84fe-49ad-b231-b89232d84bd2\",\"meta\":{\"target_revision_id\":19293,\"drupal_internal__target_id\":441}}],\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/field_page_section?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/field_page_section?resourceVersion=id%3A5903\"}}},\"field_related_collection\":{\"data\":[],\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/field_related_collection?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/field_related_collection?resourceVersion=id%3A5903\"}}},\"field_resource_type\":{\"data\":{\"type\":\"taxonomy_term--resource_type\",\"id\":\"a17f4908-9141-4b1e-82aa-e6bfe0f91a22\",\"meta\":{\"drupal_internal__target_id\":131}},\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/field_resource_type?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/field_resource_type?resourceVersion=id%3A5903\"}}},\"field_roles\":{\"data\":[],\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/field_roles?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/field_roles?resourceVersion=id%3A5903\"}}},\"field_topics\":{\"data\":[{\"type\":\"taxonomy_term--topics\",\"id\":\"c12221c3-2c7e-4eb0-903f-0470aad63bf0\",\"meta\":{\"drupal_internal__target_id\":16}}],\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/field_topics?resourceVersion=id%3A5903\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node/explainer/a986c9d1-0084-453a-a099-a3d3228aca89/relationships/field_topics?resourceVersion=id%3A5903\"}}}}},\"included\":[{\"type\":\"node_type--node_type\",\"id\":\"d185e460-4998-4d2b-85cb-b04f304dfb1b\",\"links\":{\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/node_type/node_type/d185e460-4998-4d2b-85cb-b04f304dfb1b\"}},\"attributes\":{\"langcode\":\"en\",\"status\":true,\"dependencies\":{\"module\":[\"menu_ui\",\"scheduler\"]},\"third_party_settings\":{\"menu_ui\":{\"available_menus\":[],\"parent\":\"\"},\"scheduler\":{\"expand_fieldset\":\"when_required\",\"fields_display_mode\":\"vertical_tab\",\"publish_enable\":false,\"publish_past_date\":\"error\",\"publish_past_date_created\":false,\"publish_required\":false,\"publish_revision\":false,\"publish_touch\":false,\"show_message_after_update\":true,\"unpublish_enable\":false,\"unpublish_required\":false,\"unpublish_revision\":false}},\"name\":\"Explainer page\",\"drupal_internal__type\":\"explainer\",\"description\":\"Use \u003ci\u003eExplainer pages\u003c/i\u003e to provide general information in plain language about a policy, program, tool, service, or task related to security and privacy at CMS.\",\"help\":null,\"new_revision\":true,\"preview_mode\":1,\"display_submitted\":true}},{\"type\":\"user--user\",\"id\":\"e352e203-fe9c-47ba-af75-2c7f8302fca8\",\"links\":{\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/user/user/e352e203-fe9c-47ba-af75-2c7f8302fca8\"}},\"attributes\":{\"display_name\":\"mburgess\"}},{\"type\":\"taxonomy_term--resource_type\",\"id\":\"a17f4908-9141-4b1e-82aa-e6bfe0f91a22\",\"links\":{\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22?resourceVersion=id%3A131\"}},\"attributes\":{\"drupal_internal__tid\":131,\"drupal_internal__revision_id\":131,\"langcode\":\"en\",\"revision_created\":\"2022-08-02T23:13:33+00:00\",\"status\":true,\"name\":\"General Information\",\"description\":null,\"weight\":2,\"changed\":\"2023-03-10T19:04:03+00:00\",\"default_langcode\":true,\"revision_translation_affected\":true,\"path\":{\"alias\":null,\"pid\":null,\"langcode\":\"en\"}},\"relationships\":{\"vid\":{\"data\":{\"type\":\"taxonomy_vocabulary--taxonomy_vocabulary\",\"id\":\"3a0127c4-ee06-41ed-8239-f796f6d78eb3\",\"meta\":{\"drupal_internal__target_id\":\"resource_type\"}},\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/vid?resourceVersion=id%3A131\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/relationships/vid?resourceVersion=id%3A131\"}}},\"revision_user\":{\"data\":null,\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/revision_user?resourceVersion=id%3A131\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/relationships/revision_user?resourceVersion=id%3A131\"}}},\"parent\":{\"data\":[{\"type\":\"taxonomy_term--resource_type\",\"id\":\"virtual\",\"meta\":{\"links\":{\"help\":{\"href\":\"https://www.drupal.org/docs/8/modules/json-api/core-concepts#virtual\",\"meta\":{\"about\":\"Usage and meaning of the 'virtual' resource identifier.\"}}}}}],\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/parent?resourceVersion=id%3A131\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/resource_type/a17f4908-9141-4b1e-82aa-e6bfe0f91a22/relationships/parent?resourceVersion=id%3A131\"}}}}},{\"type\":\"taxonomy_term--topics\",\"id\":\"c12221c3-2c7e-4eb0-903f-0470aad63bf0\",\"links\":{\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0?resourceVersion=id%3A16\"}},\"attributes\":{\"drupal_internal__tid\":16,\"drupal_internal__revision_id\":16,\"langcode\":\"en\",\"revision_created\":\"2022-08-02T23:05:20+00:00\",\"status\":true,\"name\":\"CMS Policy \u0026 Guidance\",\"description\":null,\"weight\":2,\"changed\":\"2023-03-10T19:04:22+00:00\",\"default_langcode\":true,\"revision_translation_affected\":true,\"path\":{\"alias\":null,\"pid\":null,\"langcode\":\"en\"}},\"relationships\":{\"vid\":{\"data\":{\"type\":\"taxonomy_vocabulary--taxonomy_vocabulary\",\"id\":\"73f89dec-123f-4c8c-9a97-d025a2b0e5cf\",\"meta\":{\"drupal_internal__target_id\":\"topics\"}},\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/vid?resourceVersion=id%3A16\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/relationships/vid?resourceVersion=id%3A16\"}}},\"revision_user\":{\"data\":null,\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/revision_user?resourceVersion=id%3A16\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/relationships/revision_user?resourceVersion=id%3A16\"}}},\"parent\":{\"data\":[{\"type\":\"taxonomy_term--topics\",\"id\":\"virtual\",\"meta\":{\"links\":{\"help\":{\"href\":\"https://www.drupal.org/docs/8/modules/json-api/core-concepts#virtual\",\"meta\":{\"about\":\"Usage and meaning of the 'virtual' resource identifier.\"}}}}}],\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/parent?resourceVersion=id%3A16\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/taxonomy_term/topics/c12221c3-2c7e-4eb0-903f-0470aad63bf0/relationships/parent?resourceVersion=id%3A16\"}}}}},{\"type\":\"paragraph--page_section\",\"id\":\"1a9d7f2e-84fe-49ad-b231-b89232d84bd2\",\"links\":{\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2?resourceVersion=id%3A19293\"}},\"attributes\":{\"drupal_internal__id\":441,\"drupal_internal__revision_id\":19293,\"langcode\":\"en\",\"status\":true,\"created\":\"2023-01-31T17:14:56+00:00\",\"parent_id\":\"636\",\"parent_type\":\"node\",\"parent_field_name\":\"field_page_section\",\"behavior_settings\":[],\"default_langcode\":true,\"revision_translation_affected\":true,\"field_text_block\":{\"value\":\"$18\",\"format\":\"body_text\",\"processed\":\"$19\"}},\"relationships\":{\"paragraph_type\":{\"data\":{\"type\":\"paragraphs_type--paragraphs_type\",\"id\":\"57f3f40a-8120-4393-b881-a5758f9fb30d\",\"meta\":{\"drupal_internal__target_id\":\"page_section\"}},\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/paragraph_type?resourceVersion=id%3A19293\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/relationships/paragraph_type?resourceVersion=id%3A19293\"}}},\"field_specialty_item\":{\"data\":null,\"links\":{\"related\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/field_specialty_item?resourceVersion=id%3A19293\"},\"self\":{\"href\":\"https://cybergeek.cms.gov/jsonapi/paragraph/page_section/1a9d7f2e-84fe-49ad-b231-b89232d84bd2/relationships/field_specialty_item?resourceVersion=id%3A19293\"}}}}}],\"includedMap\":{\"d185e460-4998-4d2b-85cb-b04f304dfb1b\":\"$1a\",\"e352e203-fe9c-47ba-af75-2c7f8302fca8\":\"$24\",\"a17f4908-9141-4b1e-82aa-e6bfe0f91a22\":\"$28\",\"c12221c3-2c7e-4eb0-903f-0470aad63bf0\":\"$42\",\"1a9d7f2e-84fe-49ad-b231-b89232d84bd2\":\"$5c\"}}}]\n"])</script><script>self.__next_f.push([1,"a:[[\"$\",\"meta\",\"0\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}],[\"$\",\"meta\",\"1\",{\"charSet\":\"utf-8\"}],[\"$\",\"title\",\"2\",{\"children\":\"Acronyms | CMS Information Security \u0026 Privacy Group\"}],[\"$\",\"meta\",\"3\",{\"name\":\"description\",\"content\":\"Common security and privacy acronyms used at CMS\"}],[\"$\",\"link\",\"4\",{\"rel\":\"canonical\",\"href\":\"https://security.cms.gov/learn/acronyms\"}],[\"$\",\"meta\",\"5\",{\"name\":\"google-site-verification\",\"content\":\"GMZIwBDJgz_o_JYUB2GpJazkrs7P85BaWDsoCjxF32M\"}],[\"$\",\"meta\",\"6\",{\"property\":\"og:title\",\"content\":\"Acronyms | CMS Information Security \u0026 Privacy Group\"}],[\"$\",\"meta\",\"7\",{\"property\":\"og:description\",\"content\":\"Common security and privacy acronyms used at CMS\"}],[\"$\",\"meta\",\"8\",{\"property\":\"og:url\",\"content\":\"https://security.cms.gov/learn/acronyms\"}],[\"$\",\"meta\",\"9\",{\"property\":\"og:image:type\",\"content\":\"image/jpeg\"}],[\"$\",\"meta\",\"10\",{\"property\":\"og:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"11\",{\"property\":\"og:image:height\",\"content\":\"630\"}],[\"$\",\"meta\",\"12\",{\"property\":\"og:image\",\"content\":\"https://security.cms.gov/learn/acronyms/opengraph-image.jpg?d21225707c5ed280\"}],[\"$\",\"meta\",\"13\",{\"property\":\"og:type\",\"content\":\"website\"}],[\"$\",\"meta\",\"14\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"15\",{\"name\":\"twitter:title\",\"content\":\"Acronyms | CMS Information Security \u0026 Privacy Group\"}],[\"$\",\"meta\",\"16\",{\"name\":\"twitter:description\",\"content\":\"Common security and privacy acronyms used at CMS\"}],[\"$\",\"meta\",\"17\",{\"name\":\"twitter:image:type\",\"content\":\"image/jpeg\"}],[\"$\",\"meta\",\"18\",{\"name\":\"twitter:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"19\",{\"name\":\"twitter:image:height\",\"content\":\"630\"}],[\"$\",\"meta\",\"20\",{\"name\":\"twitter:image\",\"content\":\"https://security.cms.gov/learn/acronyms/opengraph-image.jpg?d21225707c5ed280\"}],[\"$\",\"link\",\"21\",{\"rel\":\"icon\",\"href\":\"/favicon.ico\",\"type\":\"image/x-icon\",\"sizes\":\"48x48\"}]]\n4:null\n"])</script></body></html> |