Contingency Planning & Management

CPM Dictionary: R

Race Condition: Exploits small window of time between a security control being applied and when service is used

Radiation Authority: Usually a state agency or state designated official with responsibilities for evaluating radiological hazard conditions during normal operations and during emergencies

Radiation Monitoring: Process of receiving images, data, or audio from an unprotected source by listening to radiation signals

Radiation Sickness: Symptoms characterizing sickness known as radiation injury, resulting from excessive exposure of the entire body to ionizing radiation

Radio Bands: Collection of neighboring radio frequencies allocated on different bands; individual two-way radios, for example, use specific bands such that a radio designed to work on one band will not work on another

Radio Cache: Consists of a number of portable radios, a base station and in some cases a repeater stored in a predetermined location for dispatch to incidents

Radiological Exposure: See Exposure (Radiological)

Radiological Exposure Rate: See Exposure Rate (Radiological)

Radiological Monitoring: Process of locating and measuring radiation using survey instruments that can detect and measure (as exposure rates) ionizing radiation (FEMA)

RADIUS: See also Remote Authentication Dial-In User Service

Rapid Needs Assessment: Collection of techniques (e.g., epidemiological, statistical, anthropological) designed to provide information about an affected community's needs following a disaster

RAT (Remote Access Trojan): Program that provides access to, and control over, a network-attached computer from a remote computer or location, in effect providing a backdoor; usually installed without the direct knowledge of user or operator of the computer to be controlled

Rainbow Series: Set of more than 30 technical and policy documents with colored covers, issued by the U.S. government's NCSC, that describe the TCSEC and provide guidance for meeting and applying the criteria

Random: Sequence of values such that each successive value is obtained merely by chance and does not depend on the preceding values of the sequence; selected individual value is defined as random if each of the values in the total population of possibilities has equal probability of being selected; in cryptography and other security applications, random means not only unpredictable, but also difficult or impossible to guess. See also Pseudo-Random

Read: Fundamental computer operation that results in the flow of information from an object to a subject

Read Access: Permission to read information

Readiness: Situation in which preparedness is linked to relief; assessment of readiness reflects current capacity and capabilities of an organization that is involved in relief activities

Real-Time Scanner: See also On-Access Scanner

Reception Center: Secure area to which uninjured people can be taken for shelter, first aid, interview and documentation as appropriate to the event. See also Friends and Relatives Reception Center

Reciprocal Agreement: Documented pact between two organizations (or two internal business groups) with basically the same equipment/same environment; makes it possible for each unit to recover at the other's site

Reconnaissance: Phase of a security attack where an attacker finds new systems, maps out networks, and probes for specific, exploitable vulnerabilities

Reconstruction: Actions taken to reestablish a community or organization after a period of recovery and rehabilitation following a disaster; includes construction of new, permanent housing, full restoration of all services, and complete resumption of the pre-disaster state; must be fully integrated into ongoing long-term development plans taking account of future disaster risks and possibilities to reduce those risks by the incorporation of appropriate mitigation measures; also called Restoration

Record: Capture and store a set of data that consists of a series of actions and events; individual piece of information presented in electronic or hard-copy format

Recorders: Individuals within ICS organizational units responsible for recording information; typically found in Planning, Logistics and Finance/Administration Units

Recoverable Loss: Financial losses due to a loss incident that may be reclaimed in the future, e.g. through insurance or litigation

Recovery: Process associated with planning for and/or implementing expanded operations to address less time-sensitive business operations immediately following an interruption or disaster; 1) launch of the actual process or function that uses restored technology and alternate location; 2) long-term activities beyond initial crisis period and emergency response phase of disaster operations that focus on returning all systems in the community to a normal status or to reconstitute these systems to a new condition that is less vulnerable (FEMA); 3) actions of responders, government, and victims that help return an affected community to normal by stimulating community cohesiveness and government involvement; 4) recovery period falls between the onset of the emergency and the restoration period

Recovery Control: See also Controls

Recovery Management Team: Group of people that is responsible for recovering a predetermined aspect of the organization, or obtaining resources required for the recovery. See also BCM Team

Recovery Period: Time period between a disaster and a return to normal functions, during which a disaster recovery plan is employed

Recovery Phase: Series of actions used to restore systems to normal or near-normal operational status; includes short-term recovery actions taken to assess damage and return vital life-support systems to minimum operating standards; longer-term recovery and restoration actions may continue for years

Recovery Phase Activities (Post-disaster): Actions taken following the initial emergency phase that helps victims resume normal lives and means of livelihood, and to restore infrastructure, systems and services, and the economy in a manner appropriate to long-term needs and defined development objectives; encompasses both rehabilitation and reconstruction, and may include the continuation of certain relief or welfare measures in favor of particular disadvantaged, vulnerable groups

Recovery Plan: Sequence of actions used to restore areas affected by a disaster. See also BCM Plan

Recovery Point Objective (RPO): Point in time to which work should be restored following an unplanned operational event that interrupts/disrupts the business, e.g. ‘start of day’; often used as basis for development of backup strategies, and as a determinant of the amount of data needed to run the organization after systems and/or functions have been successfully recovered

Recovery Procedures: Actions necessary to restore a system's computational capability and data files after a system failure. See also Business Continuity Plan, Disaster Recovery Plan

Recovery Services Contract: Legal agreement with an external organization guaranteeing the provision of specified equipment, facilities, or services, usually within a specified time period, in the event of a business interruption; typically specifies a monthly subscription fee, declaration fee, usage costs, method and amount of testing, termination options, and penalties and liabilities

Recovery Site: See also Alternate Site

Recovery Strategy: Approach defined by an organization that will ensure its recovery and continuity in the face of a disaster or other major outage; used as the basis for developing plans and methodologies; more than one methodology or solution can be developed to satisfy a strategy; examples include a) contracting for hot site or cold sites, b) building an internal hot site or cold site, c) identifying an alternate work area, a consortium or reciprocal agreement, and d) contracting for mobile recovery or crate and ship services

Recovery Time Objective (RTO): Period of time within which systems, applications, or functions must be recovered after an outage (e.g. one business day); used to develop recovery strategies, and to determine whether or not to implement recovery strategies following a disaster situation; output from business impact analysis that identifies the time in which mission critical activities and/or their dependencies must be recovered. See also BIA, Dependencies, Maximum Allowable Downtime, and Mission-Critical Activities

Recovery Timeline: Critical path of actions and activities that describe the speed and prioritization of the recovery process

Recovery Window: See also Recovery Time Objective

Redundancy: Duplication of system components (such as hard drives, power sources, or processors), information (such as backup copies of software or archived files), or personnel intended to increase the reliability or availability of service and/or decrease the risk of information loss. See also Backup, Alternate Site

Re-entry Recommendation: Advice provided to the State by the Cognizant Federal Agency (CFA) in conjunction with a Senior Federal Official and appropriate Federal agencies regarding State or local government guidance or recommendations that may be issued to the public before returning to an area affected by an extraordinary situation

Reference Monitor: Access control process that refers to an abstract machine that mediates accesses to objects by subjects

Reference Validation Mechanism: Implementation of the reference monitor process; example: a security kernel

Region: Part of a network administrated by a specific user or administrator; can contain managers, domains, agents, security policies, and a summary database that contains results of the policy analyses

Region Emergency Operations Center (REOC): Facilities found at State OEM office; used to coordinate information and resources among operational areas and between the operational areas and the state level

Regional Director: Lead administrator for one of FEMA's ten Regional Offices and principal representative for working with other Federal regions, State and local governments, and the private sector in that jurisdiction

Regional Field Board: Regional group chaired by FEMA Regional Director and composed of representatives of Federal agencies that maintain a primary or secondary interest in resources involved in a crisis and that would be expected to act in response to the crisis

Regional Military Emergency Coordinator: Individual designated on behalf of the Secretary of Defense and the DoD executive agent to coordinate, exchange information, and perform liaison functions on behalf of the DoD with any Federal emergency management structure established at the regional level

Regional Office Support Team: FEMA/DHS regional team which supports Emergency Response Team in the field and facilitates interface with the Emergency Support Team in FEMA headquarters and with other regional Federal agencies and organizations

Regional Operating Center (ROC): Temporary operations facility for coordination of Federal response and recovery activities, located at FEMA/DHS Regional Office (or Federal Regional Center) and led by FEMA Regional Director or Deputy Director. See also Emergency Response Team

Regional Response Team (RRT): Designated individuals in each of the ten standard Federal regions, Alaska, and the Caribbean, for planning, preparedness, and response activities related to oil discharges and hazardous substance releases; teams receive direction from the National Response Team

Registry (Windows): Central list of settings and information required to operate a computer in the Windows environment. See also Windows Registry

Regulatory: See also Legislative, Statutory

Rehabilitation: Actions taken following a disaster to help restore basic services, assist victims' self-help efforts to repair dwellings and community facilities, and revive economic activities; actions taken after a slow launching disaster where attention must be given to the issues of resettlement or returnee programs, particularly for people who have been displaced for reasons arising out of conflict or economic collapse

Reinforced Attack: Resources requested in addition to the initial attack.

Releases Confidential Information: Process of attempting to gain access to important data stored on the computer, such as credit card numbers

Reliability: Probability of a given system performing its mission adequately for a specified period of time under expected operating conditions

Relief: Provision on a humanitarian basis of material aid and emergency medical care necessary to save and preserve human lives; supplies and services are provided, free of charge, in the period immediately following a sudden disaster; may be provided for extended periods in the case of population displacements

Relief Action: Specialized activities that can include search and rescue missions, first aid, and restoration of emergency communications and transportation systems; also includes attention to immediate care of survivors by providing food, clothing, medical treatment, and emotional care

Relief Phase: Period immediately following occurrence of a sudden disaster (or the late discovery of a neglected/deteriorated slow-onset situation) when exceptional measures must be taken to search and find survivors as well as meet their basic needs for shelter, water, food and medical care

Remap: Implement a software or configuration data modification that redirects system associations; ANSI bombs can remap an entire keyboard so as to invoke a payload command with a single keystroke

Remediation: Planned precautionary measures undertaken to improve the reliability, availability, and survivability of critical assets and/or infrastructures, particularly with regard to specific known vulnerabilities and threats; considered a part of risk management and is closely allied with safeguards and countermeasures

Remote: Computer that connects with a host computer and takes control of it in a remote control session

Remote Access Trojan: See also RAT

Remote Authentication Dial-In User Service (RADIUS): Internet protocol (RFC 2138) that transports dial-in users' authentication information and configuration information between a shared centralized authentication server (RADIUS server) and a network access server (RADIUS client) that needs to authenticate the users of its network access ports

Remote Communication: Interaction with a host by a remote computer through a telephone network connection or another communications line, such as a network or a direct serial cable connection

Remote Control Session: Process in which a remote computer calls and connects with a host computer; remote computer operates the host while the host's video display is transmitted to the remote computer's monitor

Remote Networking: Connection where a computer calls a network device, and then operates as a node on that particular network; also referred to as dial-up networking or remote access. See also Remote Control Session

Removal: Measures skill level required to remove a threat from a given computer; may involve deleting files and modifying registry entries; three levels are Difficult (requires an experienced technician), Moderate (requires some expertise), and Easy (requires little or no expertise)

Rendezvous Point (RP): Secure, safe and accessible location to which all emergency services resources arriving at an emergency/statutory services outer cordon are directed for logging, briefing, equipment issue and deployment. See also Emergency Services

Replay Attack: Occurs when valid data transmission is maliciously or fraudulently repeated, either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack

Replicate: Produce a copy or reproduce a mirror image; sometimes used to distinguish clandestine copying action done by a virus from the normal and deliberate duplication performed by the user

Replication: Process of duplicating data from one database to another

Report: Set of data that is organized and formatted according to specific criteria

Reporting Locations: Any of six facilities/locations where incident assigned assets resources may check in; includes Incident Command Post-Resources Unit (RESTAT), base camp, staging area, helibase or division supervisor for direct line assignments

Reporting Unit for Surveillance: Data source that provides information for a surveillance system; include hospitals, clinics, health posts, and mobile health units. See also Case; Epidemiologist; Surveillance

Repudiation: Denial by a system entity that was involved in an association (especially an association that transfers information) of having participated in the relationship. See also Accountability, Non-repudiation

Request for Comment (RFC): Series of notes regarding the Internet; Internet Documents can be submitted to the IETF by anyone; the IETF decides if the document becomes an RFC; precursor to an Internet Standard

Resident: Program which stays in computer memory while other programs are running, waiting for a specific trigger event; can include accessory software, activity monitoring and resident or on-access virus scanning software

Residual Risk: Level of uncontrolled risk remaining after all cost-effective actions have been taken to lessen the impact and probability of a specific risk or group of risks, subject to the organization’s risk appetite. See also Inherent Risk, Risk Appetite

Rescue Medical: Manned ground vehicle capable of providing emergency medical services Residual Capability Assessment: Analyzes the effects of a nuclear or conventional attack on U.S. resources or of a major peacetime disaster that results in the declaration of a national security emergency

Residue: Data left in storage after processing operations are complete, but before degaussing or rewriting has taken place

Resilience: Ability of an organization, staff, system, network, activity or process to absorb the impact of a business interruption, disruption and/or loss and continue to provide a minimum acceptable level of service. See also Level of Business Continuity (LBC), Component Failure

Resource Claimancy: Procedure, used during a period of attack or national security emergency, whereby authorized Federal agencies determine definitive requirements and justify the allocation of government resources needed to support programs under their jurisdiction; does not imply procurement activity, nor does it involve the Federal government as an intermediary in normal trade other than in expediting essential activities and ensuring equitable distribution of civil resources

Resource Encapsulation: Process of ensuring that a resource is not directly accessible by a subject, but rather is protected so that the reference monitor can properly mediate accesses to it

Resource Exhaustion: Attacks that tie up finite resources on a system, making them unavailable to others

Resource Hospitals: See Medical Control

Resource Management: Actions taken by a government to: a) identify sources and obtain resources needed to support disaster response activities; b) coordinate supply, allocation, distribution, and delivery of resources so that they arrive where and when most needed; and c) maintain accountability for resources used (FEMA)

Resources: Personnel and equipment available, or potentially available, for assignment to incidents or EOCs; described by kind and type, and may be used in tactical support or supervisory capacities at an incident or EOC

Resources Preparedness System: FEMA initiative to institutionalize a Federal system which, at least biennially, collects military and civil requirements based on a selected mobilization scenario, assesses the ability of U.S. resources to respond to those requirements, determines the resulting shortage/bottlenecks and recommends remedies through the Executive Branch planning, programming, and budgetary process

Resources Unit: Functional unit within ICS Planning Section responsible for recording status of resources committed to the incident; evaluates resources currently committed to the incident, the impact that additional responding resources will have on the incident, and anticipated resource needs

Respect for Autonomy: Principle of respect for human dignity and the right of individuals to decide things for themselves; important to the concept of informed consent. See also Confidentiality; Informed Consent; Privacy

Response: Reaction to an incident or emergency that results in one or more predefined actions, such as assessing damage and ascertaining the level of containment and control activity required; also defines policies, procedures and actions to be followed in the event of an emergency; 1) step or stage that immediately follows a disaster event where actions begin as a result of the event having occurred; 2) information that is responding to some stimulus; 3) may include immediate actions to save lives, protect property, and meet basic human needs during the immediate aftermath of a disaster. See also Emergency Response, Disaster Response, Immediate Response, and Damage Assessment

Response Actions: Processes that can be performed when detecting an attack; include capturing the attacker's session, resetting the session, emailing an administrator, or paging an administrator

Rest Center: Building commandeered by local authorities for temporary accommodation of evacuees

Restart: Procedure or procedures that return applications and data to a known starting point; presumes availability of a working system. See also Start Point

RESTAT: Acronym for Resource Unit; a unit within the ICS Planning Section

Restoration: Process of planning for and/or implementing procedures for the repair or relocation of primary site and its contents, and for restoration of normal operations at the primary site. See also Reconstruction

Restricted Area: Location where access is subject to special restrictions or controls

Resumption: Process of planning for and/or implementing the restarting of defined business and government operations following a disaster, usually beginning with the most critical or time-sensitive functions and continuing along a planned sequence to address all identified areas required by the business

Retrovirus: Actively attacks an antivirus program or programs in an effort to prevent detection

Reverse Address Resolution Protocol (RARP): Used by a physical machine in a local area network to learn its IP address from a gateway server's Address Resolution Protocol table or cache

Reverse Cascade System: Inverse of a cascade system that identifies the whereabouts and safety status of personnel. See also Cascade System, Call Tree, and Contact List

Reverse Engineering: Acquiring sensitive data by disassembling and analyzing the design of a system component; determining the internal workings of a system from externally available indications of function

Reverse Lookup: Process to determine the host name that corresponds to a particular IP address; uses an IP address to find a domain name

Reverse Proxy: Process that takes public HTTP requests and passes them to back-end web servers to send the content to it, so the proxy can then send content to the end-user

Richter Scale: Measures earthquake magnitude, based on a logarithmic scale such that a recording of 7 signifies a disturbance with ground motion 10 times greater than a recording of 6

Risk: Fundamentally, describes the potential for exposure to loss; example: threat of an action or inaction that will prevent an organization’s ability to achieve its business objectives; usually calculated as the product of the level of threat and the level of vulnerability. See also Impact

Risk Analysis: Also known as risk assessment, process that systematically identifies valuable system resources and threats to those resources, quantifies loss exposures (loss potential) based on estimated frequencies and costs of occurrence, and can recommend how to allocate resources as countermeasures so as to minimize total exposure; analysis lists risks in order of cost and criticality, which determines where countermeasures should be applied first

Risk Appetite: Willingness of an organization to accept a defined level of risk so as to conduct its business cost-effectively; different organizations at different stages of their existence will have different risk appetites. See also Risk Context

Risk as a Function of Hazard and Vulnerability: Method of expressing risk in the following relation: Risk = Hazard x Vulnerability. See also Hazard; Risk Assessment; Vulnerability

Risk Assessment: Process of identifying risks to a business or government agency, assessing the critical functions necessary for an organization to continue business operations, defining controls in place (or needed) to reduce organizational exposure and evaluating the cost for such controls; as with a risk analysis, this often involves an evaluation of the probabilities of a particular event; analyzes both theoretical and empirical data concerning the probabilities of known disaster hazards of particular force or intensities occurring in each area. See also Hazard Identification /Analysis; Risk Analysis; Vulnerability Analysis

Risk Avoidance: Informed decision not to become involved in a risk situation

Risk-Based Auditing: Audits that focus on risk and risk management as the audit objective

Risk Categories: Method of grouping risks of similar types under key headings, known as risk categories; these include reputation, strategy, financial, investments, operational infrastructure, business, regulatory compliance, people, technology and knowledge

Risk Classification: Categorization of risk, normally focusing on likely impact to an organization or likelihood of occurrence

Risk Concentration: Risks associated with mission critical activities and/or their dependencies, and systemic processes and people located either in the same building or close geographical proximity, that are not reproduced elsewhere

Risk Context: Environment in which risks exist; can be defined as strategic context such as the relationship between the organization and the external business environment, and the organizational context such as goals, objectives, capabilities, resources, culture and strategies. See also Risk Appetite

Risk Control: That part of risk management, which involves the implementation of policies, standards, procedures and physical changes to eliminate or minimize adverse risks. See also Risk Management

Risk Evaluation: Process of comparing actual risk levels with previously established risk criteria; used to prioritize risks for further action

Risk Event: Occurrence that could potentially lead to an adverse impact on business or function; the manifestation of a risk into a reality

Risk Factors: Measurable or observable manifestations or characteristics of a process that either indicate the presence of risk or tend to increase exposure

Risk Financing: Application of techniques to fund the treatment and consequences of risk (such as insurance); means of accounting for potential loss exposures; includes risk retention (e.g. internal contingency funds or reserves to fund losses out of operating budgets) and risk transfer techniques (e.g., insurance contracts, self-insurance, captives, sinking funds)

Risk Framework: Measurable or observable manifestations or characteristics of a process that either indicate the presence of risk or tend to increase exposure. See also Control Framework

Risk Identification: Process of identifying what can happen, why and how

Risk Level: See also Risk Profile

Risk Management: Culture, processes and structures put in place to effectively manage potential opportunities and adverse effects; since it not possible or desirable to eliminate all risk, the objective is to implement cost effective processes that reduce risks to an acceptable level, reject unacceptable risks and treat risk by financial interventions (transfer risks through insurance) or by organizational intervention (business continuity programs). See also Risk Control

Risk Management Process: Systematic and documented process of clarifying risk context and identifying, analyzing, evaluating, treating, monitoring, communicating and consulting on risks

Risk Management Team: Group of individuals who hold varying views of a system or network, including people who use the system/network, and those who define the purpose of the system/network; includes end users, system administrators, system security officers, system engineers, and data owners, residing on the network

Risk Measure: Quantitative measurement of risk; product of asset measure, threat measure, and vulnerability measure, based on defined algorithms

Risk Mitigation or Reduction: Implementation of measures to deter specific threats to the continuity of business and government operations, and/or respond to any occurrence of such threats in a timely and appropriate manner; selective application of appropriate techniques and management principles to reduce or mitigate either the likelihood of an occurrence or its consequences, or both

Risk Perception: Related to how people view risks; usually related to their attitude to risk and whether they lean more towards being a risk taker or being risk averse

Risk Prioritization: Relation of acceptable levels of risks among alternatives. See also Risk Ranking

Risk Profile: Combined result of consequence and probability. See also Risk Level

Risk Profiling: Systematic method by which all the risks and associated controls relating to an entity are identified, assessed and documented using risk management tools

Risk Ranking: Ordinal or cardinal ranking and prioritization of risks in various alternatives, projects or units. See also Risk Prioritization

Risk Reduction: Long-term measures to reduce the scale and/or duration of adverse effects of unavoidable or unpreventable disaster hazards on an at-risk society by reducing vulnerability of people, structures, services, and economic activities to the impact of known disaster hazards

Risk Retention: Intentional (or unintentional) retaining the responsibility for loss or risk financing within the organization

Risk Scenarios: Method of identifying and classifying risks using application of probabilistic events and their consequences; used to stimulate what might happen, and can be achieved through brainstorming or the use of mathematical and statistical techniques and modeling (e.g., fault tree analysis and event tree analysis)

Risk Standards: Documented rules and guidelines for managing risk that have been published globally; example: Australian/New Zealand Standard on Risk Management (AS/NZS4360: 1999)

Risk Systemic: See also Systemic Risk

Risk Transfer: Techniques that describe the means of addressing risk through insurance and similar products; includes the securitization of risk and creation of catastrophe bonds

Risk Treatment: Selection and implementation of relevant risk management options; treatments include:

• Acceptance – risks are retained by the organization;
• Avoidance – do not proceed with proposed activities due to unacceptable risk or discovering an acceptable alternative
• Reduction – reducing likelihood and/or consequence of a risk
• Transfer – shifting the risk in part or in totality to another; example: insurance

Rivest-Shamir-Adleman (RSA): Algorithm for asymmetric cryptography, invented in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman

Robert T. Stafford Disaster Relief and Emergency Assistance Act: Provides for orderly and continuing means of assistance by the Federal Government to state and local governments in carrying out their duties to alleviate suffering and damage resulting from disasters; 42 U.S.C 5121, et. seq., as amended

ROC: See Regional Operations Center

Role-Based Access Control: Assigns users to roles based on their organizational functions and determines authorization based on those roles

Roll Call: Process that ensures that all employees, visitors and contractors have been safely evacuated and accounted for following an evacuation of a building or site

ROM (Read Only Memory): Static memory used to hold programming, regardless of power conditions; used for PC boot programming

Root: Administrator account in Unix systems.

Root Authority: Certification authority (CA) at the top of a CA hierarchy

Root Kit: Collection of tools (programs) that a hacker uses to mask intrusion and obtain administrator-level access to a computer or computer network; script, set of scripts, or package of modified system programs used for gaining unauthorized root privileges (or equivalent supervisory powers) on a compromised system

Router: Devices that interconnect logical networks by forwarding information to other networks or network elements based on IP addresses

Routing Information Protocol (RIP): Distance vector protocol used for interior gateway routing which uses hop count as the sole metric of a path's cost

Routing Loop: Situation where two or more poorly configured routers repeatedly exchange the same packet over and over

RPC (Remote Program Call) Scans: Determine which RPC services are running on a machine

RS-232-C Standard: An industry standard for serial communication connections

RSA: Asymmetric cryptographic algorithm named for its 1977 inventors, Ron Rivest, Adi Shamir, and Leonard Adleman; uses the product of two large prime numbers

Rule: Logical statement that lets you respond to an event, based on predetermined criteria

Rule Set Based Access Control (RSBAC): Targets actions based on rules for entities operating on objects.

Run: Execute a program or script