Security control that can be applied to one or more agency information systems and has the following properties: 1) the development, implementation, and assessment of the control can be assigned to a responsible official or organizational element (other than the information system owner); and 2) the results from the assessment of the control can be used to support the security certification and accreditation processes of an agency information system where that control has been applied.     SOURCE: NIST 800 series, FIPS Pubs