ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-14 > Assessment Objective

PM-14 Testing, Training, and Monitoring - Assessment Objective
Determine if the following are satisfied:

PM-14a.01[01] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed;
PM-14a.01[02] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained;
PM-14a.01[03] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed;
PM-14a.01[04] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained;
PM-14a.02[01] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed;
PM-14a.02[02] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed;
PM-14b.[01] testing plans are reviewed for consistency with the organizational risk management strategy;
PM-14b.[02] training plans are reviewed for consistency with the organizational risk management strategy;
PM-14b.[03] monitoring plans are reviewed for consistency with the organizational risk management strategy;
PM-14b.[04] testing plans are reviewed for consistency with organization-wide priorities for risk response actions;
PM-14b.[05] training plans are reviewed for consistency with organization-wide priorities for risk response actions;
PM-14b.[06] monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-15 > Assessment Methods

PM-15 Security and Privacy Groups and Associations - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

risk management strategy

procedures for establishing and institutionalizing contacts with security and privacy groups and associations

lists or other records of contacts with and/or membership in security and privacy groups and associations

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for establishing and institutionalizing contact with security and privacy groups and associations

organizational personnel with information security and privacy responsibilities

personnel from selected groups and associations with which the organization has established and institutionalized contact

Test: Organizational processes for establishing and institutionalizing contact with security and privacy groups and associations

mechanisms supporting contact with security and privacy groups and associations
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-15 > Assessment Objective

PM-15 Security and Privacy Groups and Associations - Assessment Objective
Determine if the following are satisfied:

PM-15a.[01] contact is established and institutionalized with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel;
PM-15a.[02] contact is established and institutionalized with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel;
PM-15b.[01] contact is established and institutionalized with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies;
PM-15b.[02] contact is established and institutionalized with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies;
PM-15c.[01] contact is established and institutionalized with selected groups and associations within the security community to share current security information, including threats, vulnerabilities, and incidents;
PM-15c.[02] contact is established and institutionalized with selected groups and associations within the privacy community to share current privacy information, including threats, vulnerabilities, and incidents.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-16 > Assessment Methods

PM-16 Threat Awareness Program - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

threat awareness program policy

threat awareness program procedures

risk assessment results relevant to threat awareness

documentation about the cross-organization information-sharing capability

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for the threat awareness program

organizational personnel responsible for the cross-organization information-sharing capability

organizational personnel with information security and privacy responsibilities

external personnel with whom threat awareness information is shared by the organization

Test: Organizational processes for implementing the threat awareness program

organizational processes for implementing the cross-organization information-sharing capability

mechanisms supporting and/or implementing the threat awareness program

mechanisms supporting and/or implementing the cross-organization information-sharing capability
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-16 > Assessment Objective

PM-16 Threat Awareness Program - Assessment Objective
Determine if the following are satisfied:

a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-16 > PM-16(1) > Assessment Methods

PM-16(1) Automated Means for Sharing Threat Intelligence - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

threat awareness program policy

threat awareness program procedures

risk assessment results related to threat awareness

documentation about the cross-organization information-sharing capability

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for the threat awareness program

organizational personnel responsible for the cross-organization information-sharing capability

organizational personnel with information security and privacy responsibilities

external personnel with whom threat awareness information is shared by the organization

Test: Organizational processes for implementing the threat awareness program

organizational processes for implementing the cross-organization information-sharing capability

automated mechanisms supporting and/or implementing the threat awareness program

automated mechanisms supporting and/or implementing the cross-organization information-sharing capability
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-16 > PM-16(1) > Assessment Objective

PM-16(1) Automated Means for Sharing Threat Intelligence - Assessment Objective
Determine if the following are satisfied:

automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-17 > Assessment Methods

PM-17 Protecting Controlled Unclassified Information on External Systems - Assessment Methods and Objects

Examine: Controlled unclassified information policy

controlled unclassified information procedures

other relevant documents or records.

Interview: Organizational personnel with controlled unclassified information responsibilities

organizational personnel with information security responsibilities.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-17 > Assessment Objective

PM-17 Protecting Controlled Unclassified Information on External Systems - Assessment Objective
Determine if the following are satisfied:

PM-17a.[01] policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
PM-17a.[02] procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
PM-17b.[01] policy is reviewed and updated [Assignment: organization-defined frequency];
PM-17b.[02] procedures are reviewed and updated [Assignment: organization-defined frequency]
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-18 > Assessment Methods

PM-18 Privacy Program Plan - Assessment Methods and Objects

Examine: Privacy program plan

procedures addressing program plan development and implementation

procedures addressing program plan reviews, updates, and approvals

procedures addressing coordination of the program plan with relevant entities

records of program plan reviews, updates, and approvals

other relevant documents or records

Interview: Organizational personnel with privacy program planning and plan implementation responsibilities

organizational personnel with privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-18 > Assessment Objective

PM-18 Privacy Program Plan - Assessment Objective
Determine if the following are satisfied:

PM-18a.[01] an organization-wide privacy program plan that provides an overview of the agency's privacy program is developed;
PM-18a.01[01] the privacy program plan includes a description of the structure of the privacy program;
PM-18a.01[02] the privacy program plan includes a description of the resources dedicated to the privacy program;
PM-18a.02[01] the privacy program plan provides an overview of the requirements for the privacy program;
PM-18a.02[02] the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;
PM-18a.02[03] the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;
PM-18a.03[01] the privacy program plan includes the role of the senior agency official for privacy;
PM-18a.03[02] the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;
PM-18a.04[01] the privacy program plan describes management commitment;
PM-18a.04[02] the privacy program plan describes compliance;
PM-18a.04[03] the privacy program plan describes the strategic goals and objectives of the privacy program;
PM-18a.05 the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;
PM-18a.06 the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
PM-18a.[02] the privacy program plan is disseminated;
PM-18b.[01] the privacy program plan is updated [Assignment: organization-defined frequency];
PM-18b.[02] the privacy program plan is updated to address changes in federal privacy laws and policies;
PM-18b.[03] the privacy program plan is updated to address organizational changes;
PM-18b.[04] the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-19 > Assessment Methods

PM-19 Privacy Program Leadership Role - Assessment Methods and Objects

Examine: Privacy program documents, including policies, procedures, plans, and reports

public privacy notices, including Federal Register notices

privacy impact assessments

privacy risk assessments

Privacy Act statements

system of records notices

computer matching agreements and notices

contracts, information sharing agreements, and memoranda of understanding

governing requirements, including laws, executive orders, regulations, standards, and guidance

other relevant documents or records

Interview: Organizational personnel with privacy program planning and plan implementation responsibilities

organizational personnel with privacy responsibilities

senior agency official for privacy

privacy officials
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-19 > Assessment Objective

PM-19 Privacy Program Leadership Role - Assessment Objective
Determine if the following are satisfied:

PM-19[01] a senior agency official for privacy with authority, mission, accountability, and resources is appointed;
PM-19[02] the senior agency official for privacy coordinates applicable privacy requirements;
PM-19[03] the senior agency official for privacy develops applicable privacy requirements;
PM-19[04] the senior agency official for privacy implements applicable privacy requirements;
PM-19[05] the senior agency official for privacy manages privacy risks through the organization-wide privacy program.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-20 > Assessment Methods

PM-20 Dissemination of Privacy Program Information - Assessment Methods and Objects

Examine: Public website

publicly posted privacy program documents, including policies, procedures, plans, and reports

position description of the senior agency official for privacy

public privacy notices, including Federal Register notices

privacy impact assessments

privacy risk assessments

Privacy Act statements and system of records notices

computer matching agreements and notices

other relevant documents or records

Interview: Organizational personnel with privacy program information dissemination responsibilities

organizational personnel with privacy responsibilities

Test: Location, access, availability, and functionality of privacy resource webpage
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-20 > Assessment Objective

PM-20 Dissemination of Privacy Program Information - Assessment Objective
Determine if the following are satisfied:

PM-20[01] a central resource webpage is maintained on the organization's principal public website;
PM-20[02] the webpage serves as a central source of information about the organization's privacy program;
PM-20a.[01] the webpage ensures that the public has access to information about organizational privacy activities;
PM-20a.[02] the webpage ensures that the public can communicate with its senior agency official for privacy;
PM-20b.[01] the webpage ensures that organizational privacy practices are publicly available;
PM-20b.[02] the webpage ensures that organizational privacy reports are publicly available;
PM-20c. the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-20 > PM-20(1) > Assessment Methods

PM-20(1) Privacy Policies on Websites, Applications, and Digital Services - Assessment Methods and Objects

Examine: Privacy program plan

privacy policies on the agency website, mobile applications, and/or other digital services

Interview: Organizational personnel with privacy program information dissemination responsibilities

organizational personnel with privacy responsibilities

Test: Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing

organizational procedures and practices for disseminating privacy program information

mechanisms supporting the dissemination of privacy program information
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-20 > PM-20(1) > Assessment Objective

PM-20(1) Privacy Policies on Websites, Applications, and Digital Services - Assessment Objective
Determine if the following are satisfied:

PM-20(01)[01] privacy policies are developed and posted on all external-facing websites;
PM-20(01)[02] privacy policies are developed and posted on all mobile applications;
PM-20(01)[03] privacy policies are developed and posted on all other digital services;
PM-20(01)(a)[01] the privacy policies are written in plain language;
PM-20(01)(a)[02] the privacy policies are organized in a way that is easy to understand and navigate;
PM-20(01)(b)[01] the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization;
PM-20(01)(b)[02] the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization;
PM-20(01)(c)[01] the privacy policies are updated whenever the organization makes a substantive change to the practices it describes;
PM-20(01)(c)[02] the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-21 > Assessment Methods

PM-21 Accounting of Disclosures - Assessment Methods and Objects

Examine: Privacy program plan

disclosure policies and procedures

records of disclosures

audit logs

Privacy Act policies and procedures

system of records notice

Privacy Act exemption rules.

Interview: Organizational personnel with privacy program responsibilities

organizational personnel with privacy responsibilities.

Test: Organizational processes for disclosures

mechanisms supporting the accounting of disclosures, including commercial services that provide notifications and alerts.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-21 > Assessment Objective

PM-21 Accounting of Disclosures - Assessment Objective
Determine if the following are satisfied:

PM-21a. an accurate accounting of disclosures of personally identifiable information is developed and maintained;
PM-21a.01[01] the accounting includes the date of each disclosure;
PM-21a.01[02] the accounting includes the nature of each disclosure;
PM-21a.01[03] the accounting includes the purpose of each disclosure;
PM-21a.02[01] the accounting includes the name of the individual or organization to whom the disclosure was made;
PM-21a.02[02] the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;
PM-21b. the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;
PM-21c. the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-22 > Assessment Methods

PM-22 Personally Identifiable Information Quality Management - Assessment Methods and Objects

Examine: Privacy program plan

policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion

records of monitoring PII quality management practices

documentation of reviews and updates of policies and procedures

Interview: Organizational personnel with privacy program information dissemination responsibilities

organizational personnel with privacy responsibilities

Test: [Organizational processes for data quality and personally identifiable information quality management procedures

mechanisms supporting and/or implementing quality management requirements
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-22 > Assessment Objective

PM-22 Personally Identifiable Information Quality Management - Assessment Objective
Determine if the following are satisfied:

PM-22[01] organization-wide policies for personally identifiable information quality management are developed and documented;
PM-22[02] organization-wide procedures for personally identifiable information quality management are developed and documented;
PM-22a.[01] the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
PM-22a.[02] the policies address reviewing the relevance of personally identifiable information across the information life cycle;
PM-22a.[03] the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
PM-22a.[04] the policies address reviewing the completeness of personally identifiable information across the information life cycle;
PM-22a.[05] the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
PM-22a.[06] the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
PM-22a.[07] the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
PM-22a.[08] the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
PM-22b.[01] the policies address correcting or deleting inaccurate or outdated personally identifiable information;
PM-22b.[02] the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
PM-22c.[01] the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
PM-22c.[02] the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
PM-22d.[01] the policies address appeals of adverse decisions on correction or deletion requests;
PM-22d.[02] the procedures address appeals of adverse decisions on correction or deletion requests.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-23 > Assessment Methods

PM-23 Data Governance Body - Assessment Methods and Objects

Examine: Privacy program plan

documentation relating to the Data Governance Body, including documents establishing such a body, its charter of operations, and any plans and reports

records of board meetings and decisions

records of requests to review data

policies, procedures, and standards that facilitate data governance

Interview: Officials serving on the Data Governance Body (e.g., chief information officer, senior agency information security officer, and senior agency official for privacy)