ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(2) > Assessment Objective

RA-5(2) Update Vulnerabilities to Be Scanned - Assessment Objective
Determine if the following are satisfied:

the system vulnerabilities to be scanned are updated [Selection; one or more: [Assignment: organization-defined frequency] ; prior to a new scan; when new vulnerabilities are identified and reported].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(3) > Assessment Methods

RA-5(3) Breadth and Depth of Coverage - Assessment Methods and Objects

Examine: Procedures addressing vulnerability scanning

assessment report

vulnerability scanning tools and associated configuration documentation

vulnerability scanning results

patch and vulnerability management records

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for vulnerability scanning

mechanisms/tools supporting and/or implementing vulnerability scanning
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(3) > Assessment Objective

RA-5(3) Breadth and Depth of Coverage - Assessment Objective
Determine if the following are satisfied:

the breadth and depth of vulnerability scanning coverage are defined.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(4) > Assessment Methods

RA-5(4) Discoverable Information - Assessment Methods and Objects

Examine: Procedures addressing vulnerability scanning

assessment report

penetration test results

vulnerability scanning results

risk assessment report

records of corrective actions taken

incident response records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning and/or penetration testing responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel responsible for risk response

organizational personnel responsible for incident management and response

organizational personnel with security responsibilities

Test: Organizational processes for vulnerability scanning

organizational processes for risk response

organizational processes for incident management and response

mechanisms/tools supporting and/or implementing vulnerability scanning

mechanisms supporting and/or implementing risk response

mechanisms supporting and/or implementing incident management and response
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(4) > Assessment Objective

RA-5(4) Discoverable Information - Assessment Objective
Determine if the following are satisfied:

RA-05(04)[01] information about the system is discoverable;
RA-05(04)[02] [Assignment: organization-defined corrective actions] are taken when information about the system is confirmed as discoverable.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(5) > Assessment Methods

RA-5(5) Privileged Access - Assessment Methods and Objects

Examine: Risk assessment policy

procedures addressing vulnerability scanning

system design documentation

system configuration settings and associated documentation

list of system components for vulnerability scanning

personnel access authorization list

authorization credentials

access authorization records

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning responsibilities

system/network administrators

organizational personnel responsible for access control to the system

organizational personnel responsible for configuration management of the system

system developers

organizational personnel with security responsibilities

Test: Organizational processes for vulnerability scanning

organizational processes for access control

mechanisms supporting and/or implementing access control

mechanisms/tools supporting and/or implementing vulnerability scanning
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(5) > Assessment Objective

RA-5(5) Privileged Access - Assessment Objective
Determine if the following are satisfied:

privileged access authorization is implemented to [Assignment: organization-defined system components] for [Assignment: organization-defined vulnerability scanning activities].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(6) > Assessment Methods

RA-5(6) Automated Trend Analyses - Assessment Methods and Objects

Examine: Risk assessment policy

procedures addressing vulnerability scanning

system design documentation

vulnerability scanning tools and techniques documentation

vulnerability scanning results

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for vulnerability scanning

automated mechanisms/tools supporting and/or implementing vulnerability scanning

automated mechanisms supporting and/or implementing trend analysis of vulnerability scan results
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(6) > Assessment Objective

RA-5(6) Automated Trend Analyses - Assessment Objective
Determine if the following are satisfied:

the results of multiple vulnerability scans are compared using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(8) > Assessment Methods

RA-5(8) Review Historic Audit Logs - Assessment Methods and Objects

Examine: Risk assessment policy

procedures addressing vulnerability scanning

audit logs

records of audit log reviews

vulnerability scanning results

patch and vulnerability management records

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel with audit record review responsibilities

system/network administrators

organizational personnel with security responsibilities

Test: Organizational processes for vulnerability scanning

organizational process for audit record review and response

mechanisms/tools supporting and/or implementing vulnerability scanning

mechanisms supporting and/or implementing audit record review
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(8) > Assessment Objective

RA-5(8) Review Historic Audit Logs - Assessment Objective
Determine if the following are satisfied:

historic audit logs are reviewed to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(10) > Assessment Methods

RA-5(10) Correlate Scanning Information - Assessment Methods and Objects

Examine: Risk assessment policy

procedures addressing vulnerability scanning

risk assessment

vulnerability scanning tools and techniques documentation

vulnerability scanning results

vulnerability management records

audit records

event/vulnerability correlation logs

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for vulnerability scanning

mechanisms/tools supporting and/or implementing vulnerability scanning

mechanisms implementing the correlation of vulnerability scan results
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(10) > Assessment Objective

RA-5(10) Correlate Scanning Information - Assessment Objective
Determine if the following are satisfied:

the output from vulnerability scanning tools is correlated to determine the presence of multi-vulnerability and multi-hop attack vectors.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(11) > Assessment Methods

RA-5(11) Public Disclosure Program - Assessment Methods and Objects

Examine: Risk assessment policy

procedures addressing vulnerability scanning

risk assessment

vulnerability scanning tools and techniques documentation

vulnerability scanning results

vulnerability management records

audit records

public reporting channel

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for vulnerability scanning

mechanisms/tools supporting and/or implementing vulnerability scanning

mechanisms implementing the public reporting of vulnerabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(11) > Assessment Objective

RA-5(11) Public Disclosure Program - Assessment Objective
Determine if the following are satisfied:

a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-6 > Assessment Methods

RA-6 Technical Surveillance Countermeasures Survey - Assessment Methods and Objects

Examine: Risk assessment policy

procedures addressing technical surveillance countermeasures surveys

audit records/event logs

system security plan

other relevant documents or records

Interview: Organizational personnel with technical surveillance countermeasures surveys responsibilities

system/network administrators

organizational personnel with security responsibilities

Test: Organizational processes for technical surveillance countermeasures surveys

mechanisms/tools supporting and/or implementing technical surveillance countermeasure surveys
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-6 > Assessment Objective

RA-6 Technical Surveillance Countermeasures Survey - Assessment Objective
Determine if the following are satisfied:

a technical surveillance countermeasures survey is employed at [Assignment: organization-defined locations] [Selection; one or more: [Assignment: organization-defined frequency] ; when [Assignment: organization-defined events or indicators] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-7 > Assessment Methods

RA-7 Risk Response - Assessment Methods and Objects

Examine: Risk assessment policy

assessment reports

audit records/event logs

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with assessment and auditing responsibilities

system/network administrators

organizational personnel with security and privacy responsibilities

Test: Organizational processes for assessments and audits

mechanisms/tools supporting and/or implementing assessments and auditing
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-7 > Assessment Objective

RA-7 Risk Response - Assessment Objective
Determine if the following are satisfied:

RA-07[01] findings from security assessments are responded to in accordance with organizational risk tolerance;
RA-07[02] findings from privacy assessments are responded to in accordance with organizational risk tolerance;
RA-07[03] findings from monitoring are responded to in accordance with organizational risk tolerance;
RA-07[04] findings from audits are responded to in accordance with organizational risk tolerance.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-8 > Assessment Methods

RA-8 Privacy Impact Assessments - Assessment Methods and Objects

Examine: Risk assessment policy

security and privacy risk assessment reports

acquisitions documents

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with assessment and auditing responsibilities

system/network administrators

system developers

program managers

legal counsel

organizational personnel with security and privacy responsibilities

Test: Organizational processes for assessments and audits

mechanisms/tools supporting and/or implementing assessments and auditing
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-8 > Assessment Objective

RA-8 Privacy Impact Assessments - Assessment Objective
Determine if the following are satisfied:

RA-08a. privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information;
RA-08b.[01] privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology;
RA-08b.[02] privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-9 > Assessment Methods

RA-9 Criticality Analysis - Assessment Methods and Objects

Examine: Risk assessment policy

assessment reports

criticality analysis/finalized criticality for each component/subcomponent

audit records/event logs

analysis reports

system security plan

other relevant documents or records

Interview: Organizational personnel with assessment and auditing responsibilities

organizational personnel with criticality analysis responsibilities

system/network administrators

organizational personnel with security responsibilities

Test: Organizational processes for assessments and audits

mechanisms/tools supporting and/or implementing assessments and auditing
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-9 > Assessment Objective

RA-9 Criticality Analysis - Assessment Objective
Determine if the following are satisfied:

critical system components and functions are identified by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-10 > Assessment Methods

RA-10 Threat Hunting - Assessment Methods and Objects

Examine: Risk assessment policy

assessment reports

audit records/event logs

threat hunting capability

system security plan

other relevant documents or records

Interview: Organizational personnel with threat hunting responsibilities

system/network administrators

organizational personnel with security responsibilities

Test: Organizational processes for assessments and audits

mechanisms/tools supporting and/or implementing threat hunting capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-10 > Assessment Objective

RA-10 Threat Hunting - Assessment Objective
Determine if the following are satisfied:

RA-10a.01 a cyber threat capability is established and maintained to search for indicators of compromise in organizational systems;
RA-10a.02 a cyber threat capability is established and maintained to detect, track, and disrupt threats that evade existing controls;
RA-10b. the threat hunting capability is employed [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-1 > Assessment Methods

SA-1 Policy and Procedures - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

supply chain risk management policy

supply chain risk management procedures

supply chain risk management plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-1 > Assessment Objective

SA-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

SA-01a.[01] a system and services acquisition policy is developed and documented;
SA-01a.[02] the system and services acquisition policy is disseminated to [Assignment: organization-defined personnel or roles];
SA-01a.[03] system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented;
SA-01a.[04] the system and services acquisition procedures are disseminated to [Assignment: organization-defined personnel or roles];
SA-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy addresses purpose;
SA-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy addresses scope;
SA-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy addresses roles;
SA-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy addresses responsibilities;
SA-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy addresses management commitment;
SA-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy addresses coordination among organizational entities;
SA-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy addresses compliance;
SA-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
SA-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures;
SA-01c.01[01] the system and services acquisition policy is reviewed and updated [Assignment: organization-defined frequency];
SA-01c.01[02] the current system and services acquisition policy is reviewed and updated following [Assignment: organization-defined events];
SA-01c.02[01] the current system and services acquisition procedures are reviewed and updated [Assignment: organization-defined frequency];
SA-01c.02[02] the current system and services acquisition procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-2 > Assessment Methods

SA-2 Allocation of Resources - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

system and services acquisition strategy and plans

procedures addressing the allocation of resources to information security and privacy requirements

procedures addressing capital planning and investment control

organizational programming and budgeting documentation

system security plan

privacy plan

supply chain risk management policy

other relevant documents or records

Interview: Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for determining information security and privacy requirements

organizational processes for capital planning, programming, and budgeting

mechanisms supporting and/or implementing organizational capital planning, programming, and budgeting
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-2 > Assessment Objective

SA-2 Allocation of Resources - Assessment Objective
Determine if the following are satisfied:

SA-02a.[01] the high-level information security requirements for the system or system service are determined in mission and business process planning;
SA-02a.[02] the high-level privacy requirements for the system or system service are determined in mission and business process planning;
SA-02b.[01] the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process;
SA-02b.[02] the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process;
SA-02c.[01] a discrete line item for information security is established in organizational programming and budgeting documentation;
SA-02c.[02] a discrete line item for privacy is established in organizational programming and budgeting documentation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > Assessment Methods

SA-3 System Development Life Cycle - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of information security and privacy and supply chain risk management into the system development life cycle process

system development life cycle documentation

organizational risk management strategy

information security and privacy risk management strategy documentation

system security plan

privacy plan

privacy program plan

enterprise architecture documentation

role-based security and privacy training program documentation

data mapping documentation

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

organizational personnel with system life cycle development responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and documenting the system development life cycle

organizational processes for identifying system development life cycle roles and responsibilities

organizational processes for integrating information security and privacy and supply chain risk management into the system development life cycle

mechanisms supporting and/or implementing the system development life cycle