Cybersecurity Risk Management Data

[
  "351:00"
]

{
  "fn": "Export Import Bank - Office of Chief Financial Officer 202-565-3946, Option 0",
  "@type": "vcard:Contact",
  "hasEmail": "mailto:foia@exim.gov"
}

"49"

[
  "Cybersecurity Risk Management Data",
  "DAI",
  "Data Asset Inventory",
  "EXIM",
  "not public"
]

[
  "en"
]

[
  "351:000"
]

{
  "name": "EXIM",
  "@type": "org:Organization"
}

[
  "CIPSEA Determinations: Agencies are not expected to include this element in their comprehensive data inventories until it is reflected in the schema.",
  "FOIA Determination: Part of the data asset is exempt from disclosure under FOIA",
  "Open Data Indicator: Not yet determined",
  "Open Format Indicator: YES – subject to open format",
  "Open License Requirement: Not yet determined",
  "Public Data Asset Indicator: Not yet determined",
  "Restrictions: Security"
]

{
  "access": "No public access",
  "location": "Continental United States",
  "sourceID": "49",
  "sourceFile": "EXIM Data Asset Inventory_wID_2026-10-05.csv",
  "restrictions": "Restrictions: Security",
  "inventoryName": "Data Asset Inventory (DAI)",
  "dataAssetOwner": "EXIM",
  "foiaDetermination": "Part of the data asset is exempt from disclosure under FOIA",
  "openDataIndicator": "Not yet determined",
  "responsibleAgency": "EXIM",
  "openFormatIndicator": "YES – subject to open format",
  "variableDefinitions": "CSAM ID: Unique identifier assigned to a system record.
System Name: Official name used to identify an information system.
System Acronym: Abbreviated name or short identifier used for the system.
System Type: Classification of the system, such as Major Application or General Support System.
Operational Status: Lifecycle status of the system, such as planned, operational, inactive, or retired.
Mission/Purpose: Description of the business mission, operational purpose, or function supported by the system.
Organization: Agency, bureau, office, division, or organizational component associated with the system or user.
Sub-Organization: Organizational subdivision responsible for or associated with the system.
FISMA Reportable: Indicates whether the system is subject to FISMA reporting requirements.
Mission Critical: Indicates whether the system is designated as mission critical.
Financial System: Indicates whether the system supports financial functions or processes.
Contractor System: Indicates whether the system is managed, operated, hosted, or supported by a contractor.
Critical Infrastructure: Indicates whether the system supports critical infrastructure functions.
Security Classification: Security designation assigned to the system or associated information.
Confidentiality Impact Level: Security impact assigned to potential unauthorized disclosure of information.
Integrity Impact Level: Security impact assigned to potential unauthorized modification of information.
Availability Impact Level: Security impact assigned to potential loss of system or information availability.
Information Type: NIST information category processed, stored, or transmitted by the system.
Information Type Description: Description of the information category associated with the system.
Business Area: Mission, program, or operational area supported by the information type.
Categorization Justification: Explanation supporting assigned security categorization decisions.
Authorization Date: Date the system received an Authorization to Operate (ATO).
Authorization Expiration Date: Date the current authorization expires.
Authorizing Official: Individual responsible for approving system authorization decisions.
Investment Name: Name of the investment, project, or portfolio associated with the system.
OMB Unique Investment Identifier (UII): Federal investment identifier associated with budget and reporting activities.
Portfolio: Investment portfolio associated with the system.
Fiscal Year Funding Amount: Funding associated with the system for a specific fiscal year.
Location Name: Name of a facility, office, or processing location associated with the system.
Address Line 1: Primary street address associated with a system location.
Address Line 2: Secondary address information associated with a system location.
City: City associated with the system location.
State: State associated with the system location.
ZIP Code: Postal code associated with the system location.
Country: Country associated with the system location.
Related System Name: Name of a connected, dependent, inherited, or interfacing system.
Relationship Type: Type of relationship between connected systems.
Interface Type: Technical method used to connect systems.
Transfer Method: Method used to exchange information between systems.
Transfer Type: Type of information exchange occurring between systems.
Connection Protection Method: Security protections applied to system interconnections.
Relationship Expiration Date: Expiration date associated with a system relationship or authorization.
Point of Contact Name: Name of an individual responsible for a system, assessment, control, or remediation activity.
Point of Contact Title: Position title of a designated point of contact.
Point of Contact Organization: Organization associated with the point of contact.
Point of Contact Email: Email address of the point of contact.
Point of Contact Phone Number: Telephone number of the point of contact.
Control Identifier: Unique identifier associated with a security control.
Control Name: Name of a security control.
Determine If Statement: Assessment objective or testing statement associated with a control.
Control Applicability: Indicates whether a control is applicable, inherited, hybrid, or not applicable.
Implementation Status: Status indicating whether a control has been implemented.
Implementation Statement: Narrative description explaining how a security control is implemented.
Assessment Motive: Purpose or reason an assessment is being conducted.
Assessment Status: Current progress or completion status of an assessment.
Risk Factor: Characteristic or condition used when evaluating risk.
Risk Severity: Assigned severity level of a risk or finding.
Residual Risk Score: Remaining risk after implementation of mitigating controls.
RMF Task: Risk Management Framework activity associated with the system.
RMF Task Status: Current status of a Risk Management Framework activity.
POA&M ID: Unique identifier assigned to a Plan of Action and Milestones record.
POA&M Title: Name or title of a weakness, finding, or remediation effort.
POA&M Description: Detailed description of a weakness, finding, or corrective action.
POA&M Status: Current status of a POA&M item.
Workflow Status: Current routing or approval status within a CSAM workflow.
Criticality: Priority or importance assigned to a finding, risk, control, or remediation effort.
Assigned To: Individual responsible for completing an action, assessment, review, or remediation activity.
Corrective Action: Planned or completed activity intended to remediate an identified weakness.
Milestone Description: Description of a remediation milestone or planned activity.
Milestone Due Date: Planned completion date for a remediation milestone.
Milestone Completion Date: Actual date a remediation milestone was completed.
Estimated Cost: Estimated cost to remediate a finding or implement corrective action.
Delay Reason: Explanation for delayed remediation or missed milestones.
Artifact Name: Name of an uploaded supporting document.
Artifact Type: Classification of an uploaded file or evidence document.
Artifact Description: Description of the purpose or contents of an uploaded artifact.
File Name: Name of the uploaded file stored within the system.
Last Updated By: User who most recently modified a record or artifact.
Last Updated Date: Date the record or artifact was most recently modified.
Training Type: Type of training activity recorded in the system.
Training Description: Description of training content or subject matter.
Training Cost: Cost associated with training activities.
Training Recipients: Individuals or groups receiving training.
Notification Record: System-generated notification, alert, or reminder.
Audit Log Entry: System-generated record documenting a user action or system event.
Login History: Record of successful or unsuccessful user authentication activity.
Change History: Historical record documenting changes made to system records.",
  "cipseaDeterminations": "Agencies are not expected to include this element in their comprehensive data inventories until it is reflected in the schema.",
  "openLicenseRequirement": "Not yet determined",
  "publicDataAssetIndicator": "Not yet determined"
}

{
  "bbox": "POLYGON((-125 24, -66 24, -66 50, -125 50, -125 24))",
  "@type": "Location",
  "prefLabel": "Continental United States"
}

[
  "Cybersecurity Risk Management Data"
]