Resources

Glossary

Plain-language definitions of the terms that appear in technology solicitations, contracts, and compliance requirements for public agencies.

Acceptance criteria: The specific, testable conditions a deliverable must meet before an agency accepts it and pays for it. Vague criteria are the most common source of disputes on technology contracts.
Address point: A mapped location representing an addressable place, used for permitting, utility billing, and emergency call routing. Disagreement between address sources is one of the most common data problems in local government.
Advanced metering infrastructure: Meters that record consumption at intervals and report it automatically over a network, producing far more data than billing requires.
API: Application programming interface. A defined way for one software system to exchange data with another. A system with a documented, supported API can be integrated without vendor involvement for every data need.
ATO: Authority to operate. A formal decision by an authorizing official that a system's security risk is acceptable, made under the NIST Risk Management Framework. Continuous ATO keeps that decision current through automated evidence rather than periodic re-authorization.
Business associate agreement: A contract required under HIPAA between a covered entity and a vendor that handles protected health information on its behalf.
CAD: Computer-aided dispatch. The system emergency communications centers use to receive calls, dispatch units, and track incidents.
CAGE code: A Commercial and Government Entity code identifying a supplier to United States federal agencies. Often requested by state and local agencies as well.
Chargeback: Allocating shared technology costs to the departments that consume them, so that a central IT budget reflects actual demand.
CIS Controls: A prioritized set of defensive actions published by the Center for Internet Security, widely used alongside the NIST Cybersecurity Framework because the safeguards are specific.
CJIS Security Policy: The FBI's security requirements for handling criminal justice information, binding on law enforcement agencies, the agencies that support them, and their vendors.
CMAS: California Multiple Award Schedule. A California Department of General Services program that lets state and local agencies buy from vendors on pre-established terms, usually based on a federal GSA schedule.
CMMC: Cybersecurity Maturity Model Certification. The Department of Defense program for verifying that contractors handling controlled unclassified information implement NIST SP 800-171.
Content management system: The platform an agency uses to publish and maintain its website. Governance of who may publish what is as important as the software itself.
Continuous monitoring: Ongoing collection of security control evidence so that an authorization decision stays current instead of expiring on a fixed cycle.
Cooperative purchasing: Buying through a contract competitively awarded by another public entity or a purchasing cooperative, avoiding a separate solicitation. Also called piggybacking.
Cutover: The moment a system is switched from an old platform to a new one. Good cutover plans include rehearsal, validation steps, and a defined rollback.
Data sharing agreement: A written agreement between agencies setting out what data may be exchanged, for what purpose, under what protections, and for how long.
Deidentification: Removing or altering information so that a record can no longer reasonably be linked to an individual. Requirements vary by regulation.
DevSecOps: Engineering practices that automate building, testing, security scanning, and deploying software so that every release is verified the same way.
Digital twin: A data model of a physical system, such as a water network, kept current with live data and used to simulate conditions and support decisions.
DMARC: An email authentication policy that tells receiving systems what to do with messages that fail authentication checks, reducing the chance of a spoofed message from an agency domain.
Encryption at rest and in transit: Scrambling data so it is unreadable without a key, both when stored and when moving across a network. Both are expected for sensitive data.
Encumbrance: Funds reserved against an approved contract or purchase order so that they are not spent elsewhere before the obligation is paid.
Endpoint detection and response: Software that monitors laptops, desktops, and servers for malicious behavior and allows a responder to investigate and contain a compromised device.
Enterprise resource planning: The integrated finance, payroll, human resources, and procurement system at the center of an agency's administrative operations. Replacement is typically a multi-year program.
Escrow, source code: A contractual arrangement in which a vendor deposits source code with a third party, to be released to the agency if the vendor fails or stops supporting the product.
ETL and ELT: Extract, transform, load, and its variant extract, load, transform. Two orderings for moving data from source systems into an analytics platform.
Evaluation criteria: The published factors and weights by which an agency scores proposals. Publishing them clearly is what makes an evaluation defensible.
FedRAMP: Federal Risk and Authorization Management Program. The federal program for assessing and authorizing cloud services against NIST SP 800-53 baselines so agencies can reuse the authorization.
FERPA: Family Educational Rights and Privacy Act. The federal law governing student education records.
Fixed price: A contract structure in which the vendor delivers a defined scope for a set price, giving the agency budget certainty and placing estimating risk on the vendor.
Geocoding: Converting an address into map coordinates. Accuracy depends entirely on the quality of the underlying address and centerline data.
GIS: Geographic information system. Software and data for managing and analyzing location-based information such as parcels, pipes, incidents, and boundaries.
Golden record: A single authoritative version of a record, such as a person or a parcel, reconciled from several systems that each hold part of the truth.
GTFS: General Transit Feed Specification. The open data standard for transit schedules, with a real-time extension for vehicle positions and predictions.
HIPAA: Health Insurance Portability and Accountability Act. Federal law whose privacy and security rules govern protected health information held by covered entities and their business associates.
IaaS, PaaS, SaaS: Infrastructure, platform, and software as a service. The three cloud service models, differing in how much the provider manages and how much the customer controls.
Identity and access management: The systems and processes that determine who can access what: directories, authentication, single sign-on, and account lifecycle.
Incident response plan: A written plan naming who does what during a security incident, how decisions are escalated, and how the agency communicates internally and publicly.
Infrastructure as code: Defining servers, networks, and cloud resources in version-controlled code so that environments are repeatable, reviewable, and recoverable.
Intelligent document processing: Using optical character recognition and language models to extract structured data from forms, PDFs, and scanned documents.
Interoperability: The ability of systems from different vendors to exchange and use each other's data, usually through documented interfaces and shared data standards.
IT governance: The structures and processes by which an agency decides what technology to fund, who approves it, and how progress is reviewed.
IV&V: Independent verification and validation. Confirmation by a party other than the builder that a system was built correctly and meets the agency's needs.
JPA: Joint powers authority. A separate public entity formed by two or more agencies to provide a shared function such as dispatch, IT, or fire protection.
Landing zone: A pre-configured cloud foundation with account structure, identity, networking, logging, and guardrails in place before workloads are deployed.
Large language model: An artificial intelligence model that reads and generates text. Used in agencies for summarizing, drafting, classifying, extracting, and answering questions from documents.
Least privilege: Granting each account only the access its role requires, for as long as it requires it. One of the highest-value controls an agency can implement.
Low-code platform: Software such as Microsoft Power Platform, ServiceNow, or Salesforce that lets staff build forms, workflows, and applications with limited coding.
Master data management: Practices for maintaining a consistent set of shared reference records, such as vendors, parcels, or people, across multiple systems.
Mobile device management: Software that configures, secures, updates, and if necessary wipes the laptops, tablets, and phones an agency issues.
Model card: A short document accompanying a machine learning model that states its purpose, training data, performance, limitations, and monitoring.
Multi-factor authentication: Requiring something beyond a password to sign in, such as a code from an app, a passkey, or a security key. Phishing-resistant methods bind the credential to the legitimate site.
NAICS: North American Industry Classification System. Codes used in vendor registration and federal procurement to classify what a business does.
NG911: Next Generation 911. IP-based emergency call infrastructure that routes calls using GIS data and supports text and multimedia.
NIGP code: A commodity classification used by many state and local purchasing systems to categorize goods and services.
NIST Cybersecurity Framework: A voluntary structure for organizing a security program into functions, categories, and outcomes, widely used by state and local governments.
NIST SP 800-171: The federal standard for protecting controlled unclassified information in non-federal systems, required of many federal contractors and subcontractors.
NIST SP 800-53: The catalog of security and privacy controls used in federal system authorization and in FedRAMP and StateRAMP.
Non-appropriation clause: A standard public contract provision allowing an agency to terminate if a future year's funds are not appropriated.
Notice of intent to award: A published notice of which proposer an agency intends to contract with, usually starting the period in which another proposer may protest.
Observability: Logs, metrics, and traces that let an agency know a service is working, or failing, before users report it.
Owner's technical representative: An independent advisor hired by the agency to represent its technical interests during a vendor implementation.
Passkey: A phishing-resistant credential stored on a phone or computer and unlocked with a biometric or PIN, replacing passwords and one-time codes.
Penetration test: An authorized, scoped attempt to compromise systems in order to demonstrate how weaknesses could be chained together by a real attacker.
Plan of action and milestones: A tracked list of unresolved security weaknesses with owners, remediation steps, and dates, used in federal authorization processes and increasingly elsewhere.
Post-quantum cryptography: Encryption algorithms designed to resist attack by future quantum computers, now standardized and being adopted in platforms and protocols.
Privileged access management: Controls for administrator accounts, including separate credentials, vaulted passwords, approval workflows, and session recording.
Prompt injection: An attack in which text placed where a language model will read it, such as in a document or web page, redirects the model's behavior.
Protest: A formal challenge by a proposer to the conduct or outcome of a solicitation. Clear evaluation criteria and documented scoring are the best defense.
Public records: Government records that the public has a right to inspect and copy under state law, subject to exemptions. Applies to email, documents, and data in agency systems.
Purchase order: The instrument agencies use to commit funds for a purchase. Below the informal threshold it is often the entire procurement.
Records retention schedule: The agency-adopted schedule specifying how long each class of record must be kept and when it may be destroyed.
Recovery point objective: The maximum amount of data, measured in time, an agency can afford to lose in a disruption. It determines how often backups must run.
Recovery time objective: The maximum acceptable time to restore a system after a disruption. It determines the recovery architecture the agency must pay for.
Retrieval-augmented generation: An approach in which an AI assistant retrieves relevant passages from approved documents and answers only from them, with citations.
RFP, RFQ, RFI: Request for proposals, request for qualifications or quotations, and request for information. The main solicitation types agencies use; an RFI is not a solicitation.
RMF: Risk Management Framework. The NIST process for categorizing systems, selecting and implementing controls, assessing them, authorizing operation, and monitoring.
RMS: Records management system. The system law enforcement agencies use to manage incident, case, and person records.
Rostering: Automatically provisioning student and staff accounts and class membership into learning platforms from the student information system.
SAM.gov: The United States federal system where entities register to do business with federal agencies and where exclusion records are published.
Section 508: The federal accessibility requirement for information technology procured, developed, or used by federal agencies, often referenced by state and local governments.
Serverless: Cloud services in which the provider runs the code, database, and messaging, scaling automatically and charging for use rather than idle capacity.
Service level agreement: A contractual commitment to availability and response times, with defined measurement and remedies when the vendor misses them.
Single point of failure: A component whose failure takes down a whole service. Identifying them is a routine part of architecture and continuity review.
Single sign-on: Using one agency login for many applications through standards such as SAML and OpenID Connect.
SOC 2 report: An independent auditor's report on a service organization's controls. A Type II report covers operating effectiveness over a period and is more informative than a Type I.
Software bill of materials: A list of the components and versions in a software release, used to find affected systems when a vulnerability is announced.
Statement of work: The contract section describing what will be delivered, by when, under what assumptions, and how it will be accepted.
StateRAMP: A program modeled on FedRAMP that assesses cloud services against NIST SP 800-53 for state and local governments.
Statewide contract: A contract competed by a state procurement office that other public agencies may buy from, avoiding a separate solicitation.
Strangler pattern: Replacing a legacy application incrementally by routing functions one at a time to a new system while the old one keeps running.
Structured data: Markup embedded in a web page that describes its content to search engines and other machines, such as an organization, an article, or a list of questions.
Tabletop exercise: A facilitated discussion of a simulated incident with the people who would actually respond, used to test plans and decision authority.
Technical debt: Accumulated shortcuts and deferred maintenance in a system that make future change slower and riskier. Budgeting for it is cheaper than paying it in an outage.
Threat modeling: A structured review of how a system could be attacked, performed during design so that controls are chosen deliberately rather than added later.
Time and materials: A contract structure in which the agency pays for hours worked at agreed rates, usually with a not-to-exceed ceiling.
Total cost of ownership: The full cost of a system across its life: licensing, implementation, integration, hosting, support, staffing, training, and eventual replacement.
Unique Entity ID: The identifier that replaced the DUNS number for entities registered to do business with United States federal agencies.
UNSPSC: United Nations Standard Products and Services Code. A commodity classification used in some public procurement systems.
User acceptance testing: Testing performed by the agency staff who will use a system, to confirm it works for their actual work before it is accepted.
Vendor lock-in: A situation where switching vendors is impractical because data, integrations, or skills are tied to one product. Data export rights in the contract are the main defense.
Virtual desktop infrastructure: Desktops hosted centrally and accessed remotely, useful for shared workstations, contractors, and environments with strict data handling rules.
WCAG: Web Content Accessibility Guidelines. The international standard for accessible web content; Level AA of version 2.1 is the standard adopted under the ADA rule for state and local governments.
Web content accessibility: The practice of building digital services usable by people with disabilities, measured against the Web Content Accessibility Guidelines.
Work order: The unit of tracked maintenance or service work in an asset management system, and the place most operational analytics should end up.
Zero Trust: A security model in which no user, device, or network location is trusted by default and every access request is verified.
Zero-day vulnerability: A weakness exploited before a patch is available. Mitigation depends on segmentation, monitoring, and the ability to act quickly on vendor guidance.

Glossary

A

B

C

D

E

F

G

H

I

J

L

M

N

O

P

R

S

T

U

V

W

Z

Have a project or a solicitation coming up?