16
Vol. 2: TIC 3.0 Reference Architecture July 2020
Appendix A – Glossary and Definitions
Boundary: A notional concept that describes the perimeter of a zone (e.g. mobile device services, general
support system (GSS), Software-as-a-Service (SaaS), agency, etc.) within a network architecture. The
bounded area must have an information technology (IT) utility.
Internet: The internet is discussed in two capacities throughout TIC documentation:
1. A means of data and IT traffic transport.
2. An environment used for web browsing purposes, referred to as “Web.”
Managed Trusted Internet Protocol Services (MTIPS): Services under GSA’s Enterprise
Infrastructure Solutions (EIS) contract vehicle that provide TIC solutions to government clients as a
managed security service. It is of note that the EIS contract is replacing the GSA Networx contract
vehicle that is set to close out by Fiscal Year (FY) 2023.
Management Entity (MGMT): A notional concept of an entity that oversees and controls security
capabilities. The entity can be an organization, network device, tool, service, or application. The entity
can control the collection, processing, analysis, and display of information collected from the policy
enforcement (PEPs), and it allows IT professionals to control devices on the network.
National Cyber Protection System (NCPS): An integrated system-of-systems that delivers a range of
capabilities, including intrusion detection, analytics, intrusion prevention, and information sharing
capabilities that defend the civilian Federal Government's information technology infrastructure from
cyber threats. The NCPS capabilities, operationally known as EINSTEIN, are one of several tools and
capabilities that assist in federal network defense.
Policy Enforcement Point (PEP): A security device, tool, function, or application that enforces security
policies through technical capabilities.
Policy Enforcement Point Security Capabilities: Network-level capabilities that inform technical
implementation for relevant use cases.
Reference Architecture (RA): An authoritative source of information about a specific subject area that
guides and constrains the instantiations of multiple architectures and solutions.
Risk Management: The program and supporting processes to manage information security risk to
organizational operations (including mission, functions, image, reputation), organizational assets,
individuals, other organizations, and the Nation, and includes: (i) establishing the context for risk-related
activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time.
Risk Tolerance: The level of risk or degree of uncertainty that is acceptable to organizations and is a key
element of the organizational risk frame. An organization's risk tolerance level is the amount of corporate
data and systems that can be risked to an acceptable level.
Security Capability: A combination of mutually-reinforcing security controls (i.e., safeguards and
countermeasures) implemented by technical means (i.e., functionality in hardware, software, and
firmware), physical means (i.e., physical devices and protective measures), and procedural means (i.e.,
procedures performed by individuals). Security capabilities help to define protections for information
being processed, stored, or transmitted by information systems.
Security Pattern: Description of an end-to-end data flow between two trust zones. Security patterns may
have an associated set of security capabilities or guidance to secure the data flow along with one or more
of the zones.
Seeking Service Agency (SSA): An agency that obtains TIC services through an approved Multi-Service
TICAP.