ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(10) > Assessment Methods

SI-3(10) Malicious Code Analysis - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing malicious code protection

procedures addressing incident response

procedures addressing flaw remediation

system design documentation

malicious code protection mechanisms, tools, and techniques

system configuration settings and associated documentation

results from malicious code analyses

records of flaw remediation events resulting from malicious code analyses

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for malicious code protection

organizational personnel responsible for flaw remediation

organizational personnel responsible for incident response/management

Test: Organizational process for incident response

organizational process for flaw remediation

mechanisms supporting and/or implementing malicious code protection capabilities

tools and techniques for the analysis of malicious code characteristics and behavior
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(10) > Assessment Objective

SI-3(10) Malicious Code Analysis - Assessment Objective
Determine if the following are satisfied:

SI-03(10)(a) [Assignment: organization-defined tools and techniques] are employed to analyze the characteristics and behavior of malicious code;
SI-03(10)(b)[01] the results from malicious code analysis are incorporated into organizational incident response processes;
SI-03(10)(b)[02] the results from malicious code analysis are incorporated into organizational flaw remediation processes.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > Assessment Methods

SI-4 System Monitoring - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

continuous monitoring strategy

facility diagram/layout

system design documentation

system monitoring tools and techniques documentation

locations within the system where monitoring devices are deployed

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

Test: Organizational processes for system monitoring

mechanisms supporting and/or implementing system monitoring capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > Assessment Objective

SI-4 System Monitoring - Assessment Objective
Determine if the following are satisfied:

SI-04a.01 the system is monitored to detect attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives];
SI-04a.02[01] the system is monitored to detect unauthorized local connections;
SI-04a.02[02] the system is monitored to detect unauthorized network connections;
SI-04a.02[03] the system is monitored to detect unauthorized remote connections;
SI-04b. unauthorized use of the system is identified through [Assignment: organization-defined techniques and methods];
SI-04c.01 internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information;
SI-04c.02 internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization;
SI-04d.[01] detected events are analyzed;
SI-04d.[02] detected anomalies are analyzed;
SI-04e. the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
SI-04f. a legal opinion regarding system monitoring activities is obtained;
SI-04g. [Assignment: organization-defined system monitoring information] is provided to [Assignment: organization-defined personnel or roles] [Selection; one or more: as needed; [Assignment: organization-defined frequency] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(1) > Assessment Methods

SI-4(1) System-wide Intrusion Detection System - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(1) > Assessment Objective

SI-4(1) System-wide Intrusion Detection System - Assessment Objective
Determine if the following are satisfied:

SI-04(01)[01] individual intrusion detection tools are connected to a system-wide intrusion detection system;
SI-04(01)[02] individual intrusion detection tools are configured into a system-wide intrusion detection system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(2) > Assessment Methods

SI-4(2) Automated Tools and Mechanisms for Real-time Analysis - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

privacy program plan

privacy impact assessment

privacy risk management documentation

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for incident response/management

Test: Organizational processes for the near real-time analysis of events

organizational processes for system monitoring

mechanisms supporting and/or implementing system monitoring

mechanisms/tools supporting and/or implementing an analysis of events
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(2) > Assessment Objective

SI-4(2) Automated Tools and Mechanisms for Real-time Analysis - Assessment Objective
Determine if the following are satisfied:

automated tools and mechanisms are employed to support a near real-time analysis of events.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(3) > Assessment Methods

SI-4(3) Automated Tool and Mechanism Integration - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

access control policy and procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing the intrusion detection and system monitoring capability

mechanisms and tools supporting and/or implementing the access and flow control capabilities

mechanisms and tools supporting and/or implementing the integration of intrusion detection tools into the access and flow control mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(3) > Assessment Objective

SI-4(3) Automated Tool and Mechanism Integration - Assessment Objective
Determine if the following are satisfied:

SI-04(03)[01] automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into access control mechanisms;
SI-04(03)[02] automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into flow control mechanisms.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(4) > Assessment Methods

SI-4(4) Inbound and Outbound Communications Traffic - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system protocols

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing the monitoring of inbound and outbound communications traffic
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(4) > Assessment Objective

SI-4(4) Inbound and Outbound Communications Traffic - Assessment Objective
Determine if the following are satisfied:

SI-04(04)(a)[01] criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined;
SI-04(04)(a)[02] criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined;
SI-04(04)(b)[01] inbound communications traffic is monitored [Assignment: organization-defined frequency] for [Assignment: organization-defined unusual or unauthorized activities or conditions];
SI-04(04)(b)[02] outbound communications traffic is monitored [Assignment: organization-defined frequency] for [Assignment: organization-defined unusual or unauthorized activities or conditions].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(5) > Assessment Methods

SI-4(5) System-generated Alerts - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system monitoring tools and techniques documentation

system configuration settings and associated documentation

list of personnel selected to receive alerts

documentation of alerts generated based on compromise indicators

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developers

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel on the system alert notification list

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing alerts for compromise indicators
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(5) > Assessment Objective

SI-4(5) System-generated Alerts - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined personnel or roles] are alerted when system-generated [Assignment: organization-defined compromise indicators] occur.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(7) > Assessment Methods

SI-4(7) Automated Response to Suspicious Events - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

alerts and notifications generated based on detected suspicious events

records of actions taken to terminate suspicious events

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing notifications to incident response personnel

mechanisms supporting and/or implementing actions to terminate suspicious events
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(7) > Assessment Objective

SI-4(7) Automated Response to Suspicious Events - Assessment Objective
Determine if the following are satisfied:

SI-04(07)(a) [Assignment: organization-defined incident response personnel] are notified of detected suspicious events;
SI-04(07)(b) [Assignment: organization-defined least-disruptive actions] are taken upon the detection of suspicious events.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(9) > Assessment Methods

SI-4(9) Testing of Monitoring Tools and Mechanisms - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing the testing of system monitoring tools and techniques

documentation providing evidence of testing intrusion-monitoring tools

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing the testing of intrusion-monitoring tools
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(9) > Assessment Objective

SI-4(9) Testing of Monitoring Tools and Mechanisms - Assessment Objective
Determine if the following are satisfied:

intrusion-monitoring tools and mechanisms are tested [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(10) > Assessment Methods

SI-4(10) Visibility of Encrypted Communications - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system protocols

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing the visibility of encrypted communications traffic to monitoring tools
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(10) > Assessment Objective

SI-4(10) Visibility of Encrypted Communications - Assessment Objective
Determine if the following are satisfied:

provisions are made so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(11) > Assessment Methods

SI-4(11) Analyze Communications Traffic Anomalies - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

network diagram

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system monitoring logs or records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing the analysis of communications traffic
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(11) > Assessment Objective

SI-4(11) Analyze Communications Traffic Anomalies - Assessment Objective
Determine if the following are satisfied:

SI-04(11)[01] outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies;
SI-04(11)[02] outbound communications traffic at [Assignment: organization-defined interior points] is analyzed to discover anomalies.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(12) > Assessment Methods

SI-4(12) Automated Organization-generated Alerts - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

list of inappropriate or unusual activities with security and privacy implications that trigger alerts

suspicious activity reports

alerts provided to security and privacy personnel

system monitoring logs or records

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developers

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

automated mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

automated mechanisms supporting and/or implementing automated alerts to security personnel
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(12) > Assessment Objective

SI-4(12) Automated Organization-generated Alerts - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined personnel or roles] is/are alerted using [Assignment: organization-defined automated mechanisms] when [Assignment: organization-defined activities that trigger alerts] indicate inappropriate or unusual activities with security or privacy implications.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(13) > Assessment Methods

SI-4(13) Analyze Traffic and Event Patterns - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

system monitoring tools and techniques documentation

system configuration settings and associated documentation

list of profiles representing common traffic patterns and/or events

system protocols documentation

list of acceptable thresholds for false positives and false negatives

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Test: Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing the analysis of communications traffic and event patterns
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-4 > SI-4(13) > Assessment Objective

SI-4(13) Analyze Traffic and Event Patterns - Assessment Objective
Determine if the following are satisfied:

SI-04(13)(a)[01] communications traffic for the system is analyzed;
SI-04(13)(a)[02] event patterns for the system are analyzed;
SI-04(13)(b)[01] profiles representing common traffic are developed;
SI-04(13)(b)[02] profiles representing event patterns are developed;
SI-04(13)(c)[01] traffic profiles are used in tuning system-monitoring devices;
SI-04(13)(c)[02] event profiles are used in tuning system-monitoring devices.