ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > IR-6(1) > Assessment Methods

IR-6(1) Automated Reporting - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident reporting

automated mechanisms supporting incident reporting

system design documentation

system configuration settings and associated documentation

incident response plan

system security plan

other relevant documents or records

Interview: Organizational personnel with incident reporting responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for incident reporting

automated mechanisms supporting and/or implementing the reporting of security incidents
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > IR-6(1) > Assessment Objective

IR-6(1) Automated Reporting - Assessment Objective
Determine if the following are satisfied:

incidents are reported using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > IR-6(2) > Assessment Methods

IR-6(2) Vulnerabilities Related to Incidents - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident reporting

incident response plan

system security plan

privacy plan

security incident reports and associated system vulnerabilities

other relevant documents or records

Interview: Organizational personnel with incident reporting responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

personnel to whom vulnerabilities associated with security incidents are to be reported

Test: Organizational processes for incident reporting

mechanisms supporting and/or implementing the reporting of vulnerabilities associated with security incidents
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > IR-6(2) > Assessment Objective

IR-6(2) Vulnerabilities Related to Incidents - Assessment Objective
Determine if the following are satisfied:

system vulnerabilities associated with reported incidents are reported to [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > IR-6(3) > Assessment Methods

IR-6(3) Supply Chain Coordination - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing supply chain coordination and supply chain risk information sharing with the Federal Acquisition Security Council

acquisition policy

acquisition contracts

service-level agreements

incident response plan

supply chain risk management plan

system security plan

plans of other organizations involved in supply chain activities

other relevant documents or records

Interview: Organizational personnel with incident reporting responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

organization personnel with acquisition responsibilities

Test: Organizational processes for incident reporting

organizational processes for supply chain risk information sharing

mechanisms supporting and/or implementing the reporting of incident information involved in the supply chain
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > IR-6(3) > Assessment Objective

IR-6(3) Supply Chain Coordination - Assessment Objective
Determine if the following are satisfied:

incident information is provided to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-7 > Assessment Methods

IR-7 Incident Response Assistance - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response assistance

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response assistance and support responsibilities

organizational personnel with access to incident response support and assistance capability

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for incident response assistance

mechanisms supporting and/or implementing incident response assistance
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-7 > Assessment Objective

IR-7 Incident Response Assistance - Assessment Objective
Determine if the following are satisfied:

IR-07[01] an incident response support resource, integral to the organizational incident response capability, is provided;
IR-07[02] the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-7 > IR-7(1) > Assessment Methods

IR-7(1) Automation Support for Availability of Information and Support - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response assistance

automated mechanisms supporting incident response support and assistance

system design documentation

system configuration settings and associated documentation

incident response plan

system security plan

other relevant documents or records

Interview: Organizational personnel with incident response support and assistance responsibilities

organizational personnel with access to incident response support and assistance capability

organizational personnel with information security responsibilities

Test: Organizational processes for incident response assistance

automated mechanisms supporting and/or implementing an increase in the availability of incident response information and support
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-7 > IR-7(1) > Assessment Objective

IR-7(1) Automation Support for Availability of Information and Support - Assessment Objective
Determine if the following are satisfied:

the availability of incident response information and support is increased using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-7 > IR-7(2) > Assessment Methods

IR-7(2) Coordination with External Providers - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response assistance

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response support and assistance responsibilities

external providers of system protection capability

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-7 > IR-7(2) > Assessment Objective

IR-7(2) Coordination with External Providers - Assessment Objective
Determine if the following are satisfied:

IR-07(02)(a) a direct, cooperative relationship is established between its incident response capability and external providers of the system protection capability;
IR-07(02)(b) organizational incident response team members are identified to the external providers.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-8 > Assessment Methods

IR-8 Incident Response Plan - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response planning

incident response plan

system security plan

privacy plan

records of incident response plan reviews and approvals

other relevant documents or records

Interview: Organizational personnel with incident response planning responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational incident response plan and related organizational processes
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-8 > Assessment Objective

IR-8 Incident Response Plan - Assessment Objective
Determine if the following are satisfied:

IR-08a.01 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability;
IR-08a.02 an incident response plan is developed that describes the structure and organization of the incident response capability;
IR-08a.03 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization;
IR-08a.04 an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions;
IR-08a.05 an incident response plan is developed that defines reportable incidents;
IR-08a.06 an incident response plan is developed that provides metrics for measuring the incident response capability within the organization;
IR-08a.07 an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability;
IR-08a.08 an incident response plan is developed that addresses the sharing of incident information;
IR-08a.09 an incident response plan is developed that is reviewed and approved by [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency];
IR-08a.10 an incident response plan is developed that explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles].
IR-08b.[01] copies of the incident response plan are distributed to [Assignment: organization-defined incident response personnel];
IR-08b.[02] copies of the incident response plan are distributed to [Assignment: organization-defined organizational elements];
IR-08c. the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
IR-08d.[01] incident response plan changes are communicated to [Assignment: organization-defined incident response personnel];
IR-08d.[02] incident response plan changes are communicated to [Assignment: organization-defined organizational elements];
IR-08e.[01] the incident response plan is protected from unauthorized disclosure;
IR-08e.[02] the incident response plan is protected from unauthorized modification.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-8 > IR-8(1) > Assessment Methods

IR-8(1) Breaches - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response planning

incident response plan

system security plan

privacy plan

records of incident response plan reviews and approvals

other relevant documents or records

Interview: Organizational personnel with incident response planning responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational incident response plan and related organizational processes
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-8 > IR-8(1) > Assessment Objective

IR-8(1) Breaches - Assessment Objective
Determine if the following are satisfied:

IR-08(01)(a) the incident response plan for breaches involving personally identifiable information includes a process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
IR-08(01)(b) the incident response plan for breaches involving personally identifiable information includes an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms;
IR-08(01)(c) the incident response plan for breaches involving personally identifiable information includes the identification of applicable privacy requirements.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > Assessment Methods

IR-9 Information Spillage Response - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing information spillage

incident response plan

system security plan

records of information spillage alerts/notifications

list of personnel who should receive alerts of information spillage

list of actions to be performed regarding information spillage

other relevant documents or records

Interview: Organizational personnel with incident response responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for information spillage response

mechanisms supporting and/or implementing information spillage response actions and related communications
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > Assessment Objective

IR-9 Information Spillage Response - Assessment Objective
Determine if the following are satisfied:

IR-09a. [Assignment: organization-defined personnel or roles] is/are assigned the responsibility to respond to information spills;
IR-09b. the specific information involved in the system contamination is identified in response to information spills;
IR-09c. [Assignment: organization-defined personnel or roles] is/are alerted of the information spill using a method of communication not associated with the spill;
IR-09d. the contaminated system or system component is isolated in response to information spills;
IR-09e. the information is eradicated from the contaminated system or component in response to information spills;
IR-09f. other systems or system components that may have been subsequently contaminated are identified in response to information spills;
IR-09g. [Assignment: organization-defined actions] are performed in response to information spills.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > IR-9(2) > Assessment Methods

IR-9(2) Training - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing information spillage response training

information spillage response training curriculum

information spillage response training materials

incident response plan

system security plan

information spillage response training records

other relevant documents or records

Interview: Organizational personnel with incident response training responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > IR-9(2) > Assessment Objective

IR-9(2) Training - Assessment Objective
Determine if the following are satisfied:

information spillage response training is provided [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > IR-9(3) > Assessment Methods

IR-9(3) Post-spill Operations - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response

procedures addressing information spillage

incident response plan

system security plan

other relevant documents or records

Interview: Organizational personnel with incident response responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for post-spill operations
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > IR-9(3) > Assessment Objective

IR-9(3) Post-spill Operations - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined procedures] are implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > IR-9(4) > Assessment Methods

IR-9(4) Exposure to Unauthorized Personnel - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response

procedures addressing information spillage

incident response plan

system security plan

security safeguards regarding information spillage/exposure to unauthorized personnel

other relevant documents or records

Interview: Organizational personnel with incident response responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for dealing with information exposed to unauthorized personnel

mechanisms supporting and/or implementing safeguards for personnel exposed to information not within assigned access authorizations
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-9 > IR-9(4) > Assessment Objective

IR-9(4) Exposure to Unauthorized Personnel - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls] are employed for personnel exposed to information not within assigned access authorizations.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-1 > Assessment Methods

MA-1 Policy and Procedures - Assessment Methods and Objects

Examine: Maintenance policy and procedures

system security plan

privacy plan

organizational risk management strategy

other relevant documents or records

Interview: Organizational personnel with maintenance responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-1 > Assessment Objective

MA-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

MA-01a.[01] a maintenance policy is developed and documented;
MA-01a.[02] the maintenance policy is disseminated to [Assignment: organization-defined personnel or roles];
MA-01a.[03] maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented;
MA-01a.[04] the maintenance procedures are disseminated to [Assignment: organization-defined personnel or roles];
MA-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy addresses purpose;
MA-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy addresses scope;
MA-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy addresses roles;
MA-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy addresses responsibilities;
MA-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy addresses management commitment;
MA-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy addresses coordination among organizational entities;
MA-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy addresses compliance;
MA-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
MA-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures;
MA-01c.01[01] the current maintenance policy is reviewed and updated [Assignment: organization-defined frequency];
MA-01c.01[02] the current maintenance policy is reviewed and updated following [Assignment: organization-defined events];
MA-01c.02[01] the current maintenance procedures are reviewed and updated [Assignment: organization-defined frequency];
MA-01c.02[02] the current maintenance procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-2 > Assessment Methods

MA-2 Controlled Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing controlled system maintenance

maintenance records

manufacturer/vendor maintenance specifications

equipment sanitization records

media sanitization records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

organizational personnel responsible for media sanitization

system/network administrators

Test: Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the system

organizational processes for sanitizing system components

mechanisms supporting and/or implementing controlled maintenance

mechanisms implementing the sanitization of system components
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-2 > Assessment Objective

MA-2 Controlled Maintenance - Assessment Objective
Determine if the following are satisfied:

MA-02a.[01] maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements;
MA-02a.[02] maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements;
MA-02a.[03] records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements;
MA-02b.[01] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved;
MA-02b.[02] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored;
MA-02c. [Assignment: organization-defined personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
MA-02d. equipment is sanitized to remove [Assignment: organization-defined information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement;
MA-02e. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions;
MA-02f. [Assignment: organization-defined information] is included in organizational maintenance records.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-2 > MA-2(2) > Assessment Methods

MA-2(2) Automated Maintenance Activities - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing controlled system maintenance

automated mechanisms supporting system maintenance activities

system configuration settings and associated documentation

maintenance records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Automated mechanisms supporting and/or implementing controlled maintenance

automated mechanisms supporting and/or implementing the production of records of maintenance and repair actions