overlay

{
  "id": "MLC-T-CYB-003006",
  "term": "overlay",
  "field": "Cybersecurity",
  "definition": "1. A specification of security or privacy controls, control enhancements, supplemental guidance, and other supporting information employed during the tailoring process, that is intended to complement (and further refine) security control baselines. The overlay specification may be more stringent or less stringent than the original security control baseline specification and can be applied to multiple information systems.\n\n2. A specification of security controls, control enhancements, supplemental guidance, and other supporting information intended to complement (and further refine) security control baselines resulting in the initial security control set.\n\n3. A specification of security or privacy controls, control enhancements, supplemental guidance, and other supporting information employed during the tailoring process, that is intended to complement (and further refine) security control baselines. The overlay specification may be more stringent or less stringent than the original security control baseline specification and can be applied to multiple information systems. See tailoring.\n\n4. A fully specified set of security controls, control enhancements, and supplemental guidance derived from tailoring a security baseline to fit the user’s specific environment and mission.",
  "synonyms": [
    "Security Control Overlay"
  ],
  "references": [
    "CNSSI 4009-2022 from OMB Circular A-130 (2016); NIST SP 800-161r1-upd1 [11/1/2024 errata update] from NIST SP 800-53 Rev. 5; NIST SP 800-171r3 from OMB Circular A-130 (2016); NIST SP 800-37 Rev. 2 from OMB Circular A-130 (2016)",
    "CNSSI 4009-2022 from CNSSI 1253 (Appendix F)",
    "NIST SP 800-53 Rev. 5 from OMB Circular A-130 (2016); NIST SP 800-53B from OMB Circular A-130 (2016)",
    "NISTIR 8183; NISTIR 8183 Rev. 1",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/overlay/"
}