ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(3) > Assessment Objective

AT-2(3) Social Engineering and Mining - Assessment Objective
Determine if the following are satisfied:

AT-02(03)[01] literacy training on recognizing potential and actual instances of social engineering is provided;
AT-02(03)[02] literacy training on reporting potential and actual instances of social engineering is provided;
AT-02(03)[03] literacy training on recognizing potential and actual instances of social mining is provided;
AT-02(03)[04] literacy training on reporting potential and actual instances of social mining is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(4) > Assessment Methods

AT-2(4) Suspicious Communications and Anomalous System Behavior - Assessment Methods and Objects

Examine: System security plan

privacy plan

literacy training and awareness policy

procedures addressing literacy training and awareness implementation

literacy training and awareness curriculum

literacy training and awareness materials

other relevant documents or records

Interview: Organizational personnel who receive literacy training and awareness

organizational personnel with responsibilities for basic literacy training and awareness

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(4) > Assessment Objective

AT-2(4) Suspicious Communications and Anomalous System Behavior - Assessment Objective
Determine if the following are satisfied:

literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: organization-defined indicators of malicious code] is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(5) > Assessment Methods

AT-2(5) Advanced Persistent Threat - Assessment Methods and Objects

Examine: System security plan

privacy plan

literacy training and awareness policy

procedures addressing literacy training and awareness implementation

literacy training and awareness curriculum

literacy training and awareness materials

other relevant documents or records

Interview: Organizational personnel who receive literacy training and awareness

organizational personnel with responsibilities for basic literacy training and awareness

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(5) > Assessment Objective

AT-2(5) Advanced Persistent Threat - Assessment Objective
Determine if the following are satisfied:

literacy training on the advanced persistent threat is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(6) > Assessment Methods

AT-2(6) Cyber Threat Environment - Assessment Methods and Objects

Examine: System security plan

privacy plan

literacy training and awareness policy

procedures addressing literacy training and awareness training implementation

literacy training and awareness curriculum

literacy training and awareness materials

other relevant documents or records

Interview: Organizational personnel who receive literacy training and awareness

organizational personnel with responsibilities for basic literacy training and awareness

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(6) > Assessment Objective

AT-2(6) Cyber Threat Environment - Assessment Objective
Determine if the following are satisfied:

AT-02(06)(a) literacy training on the cyber threat environment is provided;
AT-02(06)(b) system operations reflects current cyber threat information.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > Assessment Methods

AT-3 Role-based Training - Assessment Methods and Objects

Examine: System security plan

privacy plan

security and privacy awareness and training policy

procedures addressing security and privacy training implementation

codes of federal regulations

security and privacy training curriculum

security and privacy training materials

training records

other relevant documents or records

Interview: Organizational personnel with responsibilities for role-based security and privacy training

organizational personnel with assigned system security and privacy roles and responsibilities

Test: Mechanisms managing role-based security and privacy training
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > Assessment Objective

AT-3 Role-based Training - Assessment Objective
Determine if the following are satisfied:

AT-03a.01[01] role-based security training is provided to [Assignment: organization-defined roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
AT-03a.01[02] role-based privacy training is provided to [Assignment: organization-defined roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
AT-03a.01[03] role-based security training is provided to [Assignment: organization-defined roles and responsibilities] [Assignment: organization-defined frequency] thereafter;
AT-03a.01[04] role-based privacy training is provided to [Assignment: organization-defined roles and responsibilities] [Assignment: organization-defined frequency] thereafter;
AT-03a.02[01] role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;
AT-03a.02[02] role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;
AT-03b.[01] role-based training content is updated [Assignment: organization-defined frequency];
AT-03b.[02] role-based training content is updated following [Assignment: organization-defined events];
AT-03c. lessons learned from internal or external security incidents or breaches are incorporated into role-based training.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(1) > Assessment Methods

AT-3(1) Environmental Controls - Assessment Methods and Objects

Examine: Security and privacy awareness and training policy

procedures addressing security and privacy training implementation

security and privacy training curriculum

security and privacy training materials

system security plan

privacy plan

training records

other relevant documents or records

Interview: Organizational personnel with responsibilities for role-based security and privacy training

organizational personnel with responsibilities for employing and operating environmental controls
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(1) > Assessment Objective

AT-3(1) Environmental Controls - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined personnel or roles] are provided with initial and refresher training [Assignment: organization-defined frequency] in the employment and operation of environmental controls.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(2) > Assessment Methods

AT-3(2) Physical Security Controls - Assessment Methods and Objects

Examine: Security and privacy awareness and training policy

procedures addressing security and privacy training implementation

security and privacy training curriculum

security and privacy training materials

system security plan

privacy plan

training records

other relevant documents or records

Interview: Organizational personnel with responsibilities for role-based security and privacy training

organizational personnel with responsibilities for employing and operating physical security controls
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(2) > Assessment Objective

AT-3(2) Physical Security Controls - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined personnel or roles] is/are provided with initial and refresher training [Assignment: organization-defined frequency] in the employment and operation of physical security controls.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(3) > Assessment Methods

AT-3(3) Practical Exercises - Assessment Methods and Objects

Examine: Security and privacy awareness and training policy

procedures addressing security and privacy awareness training implementation

security and privacy awareness training curriculum

security and privacy awareness training materials

security and privacy awareness training reports and results

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for role-based security and privacy training

organizational personnel who participate in security and privacy awareness training
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(3) > Assessment Objective

AT-3(3) Practical Exercises - Assessment Objective
Determine if the following are satisfied:

AT-03(03)[01] practical exercises in security training that reinforce training objectives are provided;
AT-03(03)[02] practical exercises in privacy training that reinforce training objectives are provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(5) > Assessment Methods

AT-3(5) Processing Personally Identifiable Information - Assessment Methods and Objects

Examine: Security and privacy awareness and training policy

procedures addressing security and privacy awareness training implementation

security and privacy awareness training curriculum

security and privacy awareness training materials

system security plan

privacy plan

organizational privacy notices

organizational policies

system of records notices

Privacy Act statements

computer matching agreements and notices

privacy impact assessments

information sharing agreements

other relevant documents or records

Interview: Organizational personnel with responsibilities for role-based security and privacy training

organizational personnel who participate in security and privacy awareness training
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-3 > AT-3(5) > Assessment Objective

AT-3(5) Processing Personally Identifiable Information - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined personnel or roles] are provided with initial and refresher training [Assignment: organization-defined frequency] in the employment and operation of personally identifiable information processing and transparency controls.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-4 > Assessment Methods

AT-4 Training Records - Assessment Methods and Objects

Examine: Security and privacy awareness and training policy

procedures addressing security and privacy training records

security and privacy awareness and training records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information security and privacy training record retention responsibilities

Test: Mechanisms supporting the management of security and privacy training records
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-4 > Assessment Objective

AT-4 Training Records - Assessment Objective
Determine if the following are satisfied:

AT-04a.[01] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;
AT-04a.[02] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;
AT-04b. individual training records are retained for [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-6 > Assessment Methods

AT-6 Training Feedback - Assessment Methods and Objects

Examine: Security awareness and training policy

procedures addressing security training records

security awareness and training records

security plan

other relevant documents or records

Interview: Organizational personnel with information security training record retention responsibilities

Test: Mechanisms supporting the management of security training records
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-6 > Assessment Objective

AT-6 Training Feedback - Assessment Objective
Determine if the following are satisfied:

feedback on organizational training results is provided [Assignment: organization-defined frequency] to [Assignment: organization-defined personnel].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-1 > Assessment Methods

AU-1 Policy and Procedures - Assessment Methods and Objects

Examine: Audit and accountability policy and procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-1 > Assessment Objective

AU-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

AU-01a.[01] an audit and accountability policy is developed and documented;
AU-01a.[02] the audit and accountability policy is disseminated to [Assignment: organization-defined personnel or roles];
AU-01a.[03] audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented;
AU-01a.[04] the audit and accountability procedures are disseminated to [Assignment: organization-defined personnel or roles];
AU-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses purpose;
AU-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses scope;
AU-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses roles;
AU-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses responsibilities;
AU-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses management commitment;
AU-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses coordination among organizational entities;
AU-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses compliance;
AU-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
AU-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures;
AU-01c.01[01] the current audit and accountability policy is reviewed and updated [Assignment: organization-defined frequency];
AU-01c.01[02] the current audit and accountability policy is reviewed and updated following [Assignment: organization-defined events];
AU-01c.02[01] the current audit and accountability procedures are reviewed and updated [Assignment: organization-defined frequency];
AU-01c.02[02] the current audit and accountability procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-2 > Assessment Methods

AU-2 Event Logging - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing auditable events

system security plan

privacy plan

system design documentation

system configuration settings and associated documentation

system audit records

system auditable events

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms implementing system auditing
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-2 > Assessment Objective

AU-2 Event Logging - Assessment Objective
Determine if the following are satisfied:

AU-02a. [Assignment: organization-defined event types] that the system is capable of logging are identified in support of the audit logging function;
AU-02b. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
AU-02c.[01] [Assignment: organization-defined event types (subset of AU-02_ODP[01])] are specified for logging within the system;
AU-02c.[02] the specified event types are logged within the system [Assignment: organization-defined frequency or situation];
AU-02d. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;
AU-02e. the event types selected for logging are reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-3 > Assessment Methods

AU-3 Content of Audit Records - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing content of audit records

system design documentation

system configuration settings and associated documentation

list of organization-defined auditable events

system audit records

system incident reports

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms implementing system auditing of auditable events
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-3 > Assessment Objective

AU-3 Content of Audit Records - Assessment Objective
Determine if the following are satisfied:

AU-03a. audit records contain information that establishes what type of event occurred;
AU-03b. audit records contain information that establishes when the event occurred;
AU-03c. audit records contain information that establishes where the event occurred;
AU-03d. audit records contain information that establishes the source of the event;
AU-03e. audit records contain information that establishes the outcome of the event;
AU-03f. audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-3 > AU-3(1) > Assessment Methods

AU-3(1) Additional Audit Information - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing content of audit records

system security plan

privacy plan

system design documentation

system configuration settings and associated documentation

list of organization-defined auditable events

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: system audit capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-3 > AU-3(1) > Assessment Objective

AU-3(1) Additional Audit Information - Assessment Objective
Determine if the following are satisfied:

generated audit records contain the following [Assignment: organization-defined additional information].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-3 > AU-3(3) > Assessment Methods

AU-3(3) Limit Personally Identifiable Information Elements - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

privacy risk assessment

privacy risk assessment results

procedures addressing content of audit records

system design documentation

system configuration settings and associated documentation

list of organization-defined auditable events

system audit records

third party contracts

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: system audit capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-3 > AU-3(3) > Assessment Objective

AU-3(3) Limit Personally Identifiable Information Elements - Assessment Objective
Determine if the following are satisfied:

personally identifiable information contained in audit records is limited to [Assignment: organization-defined elements] identified in the privacy risk assessment.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-4 > Assessment Methods

AU-4 Audit Log Storage Capacity - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing audit storage capacity

system security plan

privacy plan

system design documentation

system configuration settings and associated documentation

audit record storage requirements

audit record storage capability for system components

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Audit record storage capacity and related configuration settings
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-4 > Assessment Objective

AU-4 Audit Log Storage Capacity - Assessment Objective
Determine if the following are satisfied:

audit log storage capacity is allocated to accommodate [Assignment: organization-defined audit log retention requirements].