ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > SC-5(1) > Assessment Methods

SC-5(1) Restrict Ability to Attack Other Systems - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing denial-of-service protection

system design documentation

list of denial-of-service attacks launched by individuals against systems

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with incident response responsibilities

system developer

Test: Mechanisms restricting the ability to launch denial-of-service attacks against other systems
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > SC-5(1) > Assessment Objective

SC-5(1) Restrict Ability to Attack Other Systems - Assessment Objective
Determine if the following are satisfied:

the ability of individuals to launch [Assignment: organization-defined denial-of-service attacks] against other systems is restricted.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > SC-5(2) > Assessment Methods

SC-5(2) Capacity, Bandwidth, and Redundancy - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing denial-of-service protection

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with incident response responsibilities

system developer

Test: Mechanisms implementing the management of system bandwidth, capacity, and redundancy to limit the effects of information flooding denial-of-service attacks
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > SC-5(2) > Assessment Objective

SC-5(2) Capacity, Bandwidth, and Redundancy - Assessment Objective
Determine if the following are satisfied:

capacity, bandwidth, or other redundancies to limit the effects of information flooding denial-of-service attacks are managed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > SC-5(3) > Assessment Methods

SC-5(3) Detection and Monitoring - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing denial-of-service protection

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with detection and monitoring responsibilities

Test: Mechanisms/tools implementing system monitoring for denial-of-service attacks
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > SC-5(3) > Assessment Objective

SC-5(3) Detection and Monitoring - Assessment Objective
Determine if the following are satisfied:

SC-05(03)(a) [Assignment: organization-defined monitoring tools] are employed to detect indicators of denial-of-service attacks against or launched from the system;
SC-05(03)(b) [Assignment: organization-defined system resources] are monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-6 > Assessment Methods

SC-6 Resource Availability - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing prioritization of system resources

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing a resource allocation capability

safeguards employed to protect availability of resources
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-6 > Assessment Objective

SC-6 Resource Availability - Assessment Objective
Determine if the following are satisfied:

the availability of resources is protected by allocating [Assignment: organization-defined resources] by [Selection; one or more: priority; quota; [Assignment: organization-defined controls] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > Assessment Methods

SC-7 Boundary Protection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

list of key internal boundaries of the system

system design documentation

boundary protection hardware and software

system configuration settings and associated documentation

enterprise security architecture documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing boundary protection capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > Assessment Objective

SC-7 Boundary Protection - Assessment Objective
Determine if the following are satisfied:

SC-07a.[01] communications at external managed interfaces to the system are monitored;
SC-07a.[02] communications at external managed interfaces to the system are controlled;
SC-07a.[03] communications at key internal managed interfaces within the system are monitored;
SC-07a.[04] communications at key internal managed interfaces within the system are controlled;
SC-07b. subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks;
SC-07c. external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(3) > Assessment Methods

SC-7(3) Access Points - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

boundary protection hardware and software

system architecture and configuration documentation

system configuration settings and associated documentation

communications and network traffic monitoring logs

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing boundary protection capabilities

mechanisms limiting the number of external network connections to the system
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(3) > Assessment Objective

SC-7(3) Access Points - Assessment Objective
Determine if the following are satisfied:

the number of external network connections to the system is limited.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(4) > Assessment Methods

SC-7(4) External Telecommunications Services - Assessment Methods and Objects

Examine: System and communications protection policy

traffic flow policy

information flow control policy

procedures addressing boundary protection

system security architecture

system design documentation

boundary protection hardware and software

system architecture and configuration documentation

system configuration settings and associated documentation

records of traffic flow policy exceptions

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Organizational processes for documenting and reviewing exceptions to the traffic flow policy

organizational processes for removing exceptions to the traffic flow policy

mechanisms implementing boundary protection capabilities

managed interfaces implementing traffic flow policy
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(4) > Assessment Objective

SC-7(4) External Telecommunications Services - Assessment Objective
Determine if the following are satisfied:

SC-07(04)(a) a managed interface is implemented for each external telecommunication service;
SC-07(04)(b) a traffic flow policy is established for each managed interface;
SC-07(04)(c)[01] the confidentiality of the information being transmitted across each interface is protected;
SC-07(04)(c)[02] the integrity of the information being transmitted across each interface is protected;
SC-07(04)(d) each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need;
SC-07(04)(e)[01] exceptions to the traffic flow policy are reviewed [Assignment: organization-defined frequency];
SC-07(04)(e)[02] exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed;
SC-07(04)(f) unauthorized exchanges of control plan traffic with external networks are prevented;
SC-07(04)(g) information is published to enable remote networks to detect unauthorized control plane traffic from internal networks;
SC-07(04)(h) unauthorized control plane traffic is filtered from external networks.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(5) > Assessment Methods

SC-7(5) Deny by Default - Allow by Exception - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing traffic management at managed interfaces
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(5) > Assessment Objective

SC-7(5) Deny by Default - Allow by Exception - Assessment Objective
Determine if the following are satisfied:

SC-07(05)[01] network communications traffic is denied by default [Selection; one or more: at managed interfaces; for [Assignment: organization-defined systems] ];
SC-07(05)[02] network communications traffic is allowed by exception [Selection; one or more: at managed interfaces; for [Assignment: organization-defined systems] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(7) > Assessment Methods

SC-7(7) Split Tunneling for Remote Devices - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing boundary protection capabilities

mechanisms supporting/restricting non-remote connections
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(7) > Assessment Objective

SC-7(7) Split Tunneling for Remote Devices - Assessment Objective
Determine if the following are satisfied:

split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(8) > Assessment Methods

SC-7(8) Route Traffic to Authenticated Proxy Servers - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing traffic management through authenticated proxy servers at managed interfaces
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(8) > Assessment Objective

SC-7(8) Route Traffic to Authenticated Proxy Servers - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined internal communications traffic] is routed to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(9) > Assessment Methods

SC-7(9) Restrict Threatening Outgoing Communications Traffic - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing boundary protection capabilities

mechanisms implementing the detection and denial of threatening outgoing communications traffic

mechanisms implementing auditing of outgoing communications traffic
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(9) > Assessment Objective

SC-7(9) Restrict Threatening Outgoing Communications Traffic - Assessment Objective
Determine if the following are satisfied:

SC-07(09)(a)[01] outgoing communications traffic posing a threat to external systems is detected;
SC-07(09)(a)[02] outgoing communications traffic posing a threat to external systems is denied;
SC-07(09)(b) the identity of internal users associated with denied communications is audited.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(10) > Assessment Methods

SC-7(10) Prevent Exfiltration - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing boundary protection capabilities that prevent the unauthorized exfiltration of information across managed interfaces
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(10) > Assessment Objective

SC-7(10) Prevent Exfiltration - Assessment Objective
Determine if the following are satisfied:

SC-07(10)(a) the exfiltration of information is prevented;
SC-07(10)(b) exfiltration tests are conducted [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(11) > Assessment Methods

SC-7(11) Restrict Incoming Communications Traffic - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing boundary protection capabilities with respect to source/destination address pairs
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(11) > Assessment Objective

SC-7(11) Restrict Incoming Communications Traffic - Assessment Objective
Determine if the following are satisfied:

only incoming communications from [Assignment: organization-defined authorized sources] are allowed to be routed to [Assignment: organization-defined authorized destinations].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(12) > Assessment Methods

SC-7(12) Host-based Protection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

boundary protection hardware and software

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

system users

Test: Mechanisms implementing host-based boundary protection capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(12) > Assessment Objective

SC-7(12) Host-based Protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined host-based boundary protection mechanisms] are implemented at [Assignment: organization-defined system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(13) > Assessment Methods

SC-7(13) Isolation of Security Tools, Mechanisms, and Support Components - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

list of security tools and support components to be isolated from other internal system components

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the isolation of information security tools, mechanisms, and support components
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(13) > Assessment Objective

SC-7(13) Isolation of Security Tools, Mechanisms, and Support Components - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined information security tools, mechanisms, and support components] are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(14) > Assessment Methods

SC-7(14) Protect Against Unauthorized Physical Connections - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

facility communications and wiring diagram system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing protection against unauthorized physical connections
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(14) > Assessment Objective

SC-7(14) Protect Against Unauthorized Physical Connections - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined managed interfaces] are protected against unauthorized physical connections.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(15) > Assessment Methods

SC-7(15) Networked Privileged Accesses - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

audit logs

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the routing of networked, privileged access through dedicated, managed interfaces
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(15) > Assessment Objective

SC-7(15) Networked Privileged Accesses - Assessment Objective
Determine if the following are satisfied:

SC-07(15)[01] networked, privileged accesses are routed through a dedicated, managed interface for purposes of access control;
SC-07(15)[02] networked, privileged accesses are routed through a dedicated, managed interface for purposes of auditing.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(16) > Assessment Methods

SC-7(16) Prevent Discovery of System Components - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the prevention of discovery of system components at managed interfaces
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(16) > Assessment Objective

SC-7(16) Prevent Discovery of System Components - Assessment Objective
Determine if the following are satisfied:

the discovery of specific system components that represent a managed interface is prevented.