ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(4) > Assessment Methods

CM-8(4) Accountability Information - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system security plan

system component inventory

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing the system component inventory

mechanisms supporting and/or implementing the system component inventory
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(4) > Assessment Objective

CM-8(4) Accountability Information - Assessment Objective
Determine if the following are satisfied:

individuals responsible and accountable for administering system components are identified by [Selection; one or more: name; position; role] in the system component inventory.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(6) > Assessment Methods

CM-8(6) Assessed Configurations and Approved Deviations - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system security plan

system design documentation

system component inventory

system configuration settings and associated documentation

change control records

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

organizational personnel with assessment responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing the system component inventory

mechanisms supporting and/or implementing system component inventory
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(6) > Assessment Objective

CM-8(6) Assessed Configurations and Approved Deviations - Assessment Objective
Determine if the following are satisfied:

CM-08(06)[01] assessed component configurations are included in the system component inventory;
CM-08(06)[02] any approved deviations to current deployed configurations are included in the system component inventory.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(7) > Assessment Methods

CM-8(7) Centralized Repository - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system design documentation

system security plan

system component inventory

system configuration settings and associated documentation

change control records

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for managing the system component inventory

mechanisms supporting and/or implementing system component inventory
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(7) > Assessment Objective

CM-8(7) Centralized Repository - Assessment Objective
Determine if the following are satisfied:

a centralized repository for the system component inventory is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(8) > Assessment Methods

CM-8(8) Automated Location Tracking - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system design documentation

system component inventory

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Organizational processes for managing the system component inventory

automated mechanisms supporting and/or implementing system component inventory

automated mechanisms supporting and/or implementing tracking of components by geographic locations
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(8) > Assessment Objective

CM-8(8) Automated Location Tracking - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined automated mechanisms] are used to support the tracking of system components by geographic location.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(9) > Assessment Methods

CM-8(9) Assignment of Components to Systems - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system security plan

system design documentation

system component inventory

change control records

acknowledgements of system component assignments

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

system owner

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for assigning components to systems

organizational processes for acknowledging assignment of components to systems

mechanisms implementing assignment of components to the system

mechanisms implementing acknowledgment of assignment of components to the system
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(9) > Assessment Objective

CM-8(9) Assignment of Components to Systems - Assessment Objective
Determine if the following are satisfied:

CM-08(09)(a) system components are assigned to a system;
CM-08(09)(b) an acknowledgement of the component assignment is received from [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-9 > Assessment Methods

CM-9 Configuration Management Plan - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing configuration management planning

configuration management plan

system design documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for developing the configuration management plan

organizational personnel with responsibilities for implementing and managing processes defined in the configuration management plan

organizational personnel with responsibilities for protecting the configuration management plan

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Organizational processes for developing and documenting the configuration management plan

organizational processes for identifying and managing configuration items

organizational processes for protecting the configuration management plan

mechanisms implementing the configuration management plan

mechanisms for managing configuration items

mechanisms for protecting the configuration management plan
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-9 > Assessment Objective

CM-9 Configuration Management Plan - Assessment Objective
Determine if the following are satisfied:

CM-09[01] a configuration management plan for the system is developed and documented;
CM-09[02] a configuration management plan for the system is implemented;
CM-09a.[01] the configuration management plan addresses roles;
CM-09a.[02] the configuration management plan addresses responsibilities;
CM-09a.[03] the configuration management plan addresses configuration management processes and procedures;
CM-09b.[01] the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle;
CM-09b.[02] the configuration management plan establishes a process for managing the configuration of the configuration items;
CM-09c.[01] the configuration management plan defines the configuration items for the system;
CM-09c.[02] the configuration management plan places the configuration items under configuration management;
CM-09d. the configuration management plan is reviewed and approved by [Assignment: organization-defined personnel or roles];
CM-09e.[01] the configuration management plan is protected from unauthorized disclosure;
CM-09e.[02] the configuration management plan is protected from unauthorized modification.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-9 > CM-9(1) > Assessment Methods

CM-9(1) Assignment of Responsibility - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing responsibilities for configuration management process development

configuration management plan

system security plan

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for configuration management process development

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-9 > CM-9(1) > Assessment Objective

CM-9(1) Assignment of Responsibility - Assessment Objective
Determine if the following are satisfied:

the responsibility for developing the configuration management process is assigned to organizational personnel who are not directly involved in system development.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-10 > Assessment Methods

CM-10 Software Usage Restrictions - Assessment Methods and Objects

Examine: Configuration management policy

software usage restrictions

software contract agreements and copyright laws

site license documentation

list of software usage restrictions

software license tracking reports

configuration management plan

system security plan

system security plan

other relevant documents or records

Interview: Organizational personnel operating, using, and/or maintaining the system

organizational personnel with software license management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for tracking the use of software protected by quantity licenses

organizational processes for controlling/documenting the use of peer-to-peer file sharing technology

mechanisms implementing software license tracking

mechanisms implementing and controlling the use of peer-to-peer files sharing technology
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-10 > Assessment Objective

CM-10 Software Usage Restrictions - Assessment Objective
Determine if the following are satisfied:

CM-10a. software and associated documentation are used in accordance with contract agreements and copyright laws;
CM-10b. the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution;
CM-10c. the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-10 > CM-10(1) > Assessment Methods

CM-10(1) Open-source Software - Assessment Methods and Objects

Examine: Configuration management policy

software usage restrictions

software contract agreements and copyright laws

site license documentation

list of software usage restrictions

software license tracking reports

configuration management plan

system security plan

system security plan

other relevant documents or records

Interview: Organizational personnel operating, using, and/or maintaining the system

organizational personnel with software license management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for tracking the use of software protected by quantity licenses

organizational processes for controlling/documenting the use of peer-to-peer file sharing technology

mechanisms implementing software license tracking

mechanisms implementing and controlling the use of peer-to-peer files sharing technology
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-10 > CM-10(1) > Assessment Objective

CM-10(1) Open-source Software - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined restrictions] are established for the use of open-source software.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-11 > Assessment Methods

CM-11 User-installed Software - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing user-installed software

configuration management plan

system security plan

system design documentation

system configuration settings and associated documentation

list of rules governing user installed software

system monitoring records

system audit records

continuous monitoring strategy

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for governing user-installed software

organizational personnel operating, using, and/or maintaining the system

organizational personnel monitoring compliance with user-installed software policy

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes governing user-installed software on the system

mechanisms enforcing policies and methods for governing the installation of software by users

mechanisms monitoring policy compliance
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-11 > Assessment Objective

CM-11 User-installed Software - Assessment Objective
Determine if the following are satisfied:

CM-11a. [Assignment: organization-defined policies] governing the installation of software by users are established;
CM-11b. software installation policies are enforced through [Assignment: organization-defined methods];
CM-11c. compliance with [Assignment: organization-defined policies] is monitored [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-11 > CM-11(2) > Assessment Methods

CM-11(2) Software Installation with Privileged Status - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing user-installed software

configuration management plan

system security plan

system design documentation

system configuration settings and associated documentation

alerts/notifications of unauthorized software installations

system audit records

continuous monitoring strategy

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for governing user-installed software

organizational personnel operating, using, and/or maintaining the system

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes governing user-installed software on the system

mechanisms for prohibiting installation of software without privileged status (e.g., access controls)
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-11 > CM-11(2) > Assessment Objective

CM-11(2) Software Installation with Privileged Status - Assessment Objective
Determine if the following are satisfied:

user installation of software is allowed only with explicit privileged status.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-11 > CM-11(3) > Assessment Methods

CM-11(3) Automated Enforcement and Monitoring - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing user-installed software

configuration management plan

system security plan

system design documentation

system configuration settings and associated documentation

list of rules governing user installed software

system monitoring records

system audit records

continuous monitoring strategy

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for governing user-installed software

organizational personnel operating, using, and/or maintaining the system

organizational personnel monitoring compliance with user-installed software policy

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes governing user-installed software on the system

automated mechanisms enforcing policies on installation of software by users

automated mechanisms monitoring policy compliance
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-11 > CM-11(3) > Assessment Objective

CM-11(3) Automated Enforcement and Monitoring - Assessment Objective
Determine if the following are satisfied:

CM-11(03)[01] compliance with software installation policies is enforced using [Assignment: organization-defined automated mechanisms];
CM-11(03)[02] compliance with software installation policies is monitored using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-12 > Assessment Methods

CM-12 Information Location - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing identification and documentation of information location

configuration management plan

system design documentation

system architecture documentation

PII inventory documentation

data mapping documentation

audit records

list of users with system and system component access

change control records

system component inventory

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing information location and user access to information

organizational personnel with responsibilities for operating, using, and/or maintaining the system

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Organizational processes governing information location

mechanisms enforcing policies and methods for governing information location
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-12 > Assessment Objective

CM-12 Information Location - Assessment Objective
Determine if the following are satisfied:

CM-12a.[01] the location of [Assignment: organization-defined information] is identified and documented;
CM-12a.[02] the specific system components on which [Assignment: organization-defined information] is processed are identified and documented;
CM-12a.[03] the specific system components on which [Assignment: organization-defined information] is stored are identified and documented;
CM-12b.[01] the users who have access to the system and system components where [Assignment: organization-defined information] is processed are identified and documented;
CM-12b.[02] the users who have access to the system and system components where [Assignment: organization-defined information] is stored are identified and documented;
CM-12c.[01] changes to the location (i.e., system or system components) where [Assignment: organization-defined information] is processed are documented;
CM-12c.[02] changes to the location (i.e., system or system components) where [Assignment: organization-defined information] is stored are documented.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-12 > CM-12(1) > Assessment Methods

CM-12(1) Automated Tools to Support Information Location - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing identification and documentation of information location

configuration management plan

system design documentation

PII inventory documentation

data mapping documentation

change control records

system component inventory

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing information location

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Organizational processes governing information location

automated mechanisms enforcing policies and methods for governing information location

automated tools used to identify information on system components
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-12 > CM-12(1) > Assessment Objective

CM-12(1) Automated Tools to Support Information Location - Assessment Objective
Determine if the following are satisfied:

automated tools are used to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure that controls are in place to protect organizational information and individual privacy.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-13 > Assessment Methods

CM-13 Data Action Mapping - Assessment Methods and Objects

Examine: Configuration management policy

procedures for identification and documentation of information location

procedures for mapping data actions

configuration management plan

system security plan

privacy plan

system design documentation

PII inventory documentation

data mapping documentation

change control records

system component inventory

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing information location

organizational personnel responsible for data action mapping

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Organizational processes governing information location

mechanisms supporting or implementing data action mapping
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-13 > Assessment Objective

CM-13 Data Action Mapping - Assessment Objective
Determine if the following are satisfied:

a map of system data actions is developed and documented.