ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
CA > CA-1 > Discussion

CA-1 Policy and Procedures - Discussion
Family: Assessment, Authorization, and Monitoring (CA)

Assessment, authorization, and monitoring policy and procedures address the controls in the CA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of assessment, authorization, and monitoring policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to assessment, authorization, and monitoring policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-2

CA-2 Control Assessments
Family: Assessment, Authorization, and Monitoring (CA)

a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
b. Develop a control assessment plan that describes the scope of the assessment including:
1. Controls and control enhancements under assessment;
2. Assessment procedures to be used to determine control effectiveness; and
3. Assessment environment, assessment team, and assessment roles and responsibilities;
c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
d. Assess the controls in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
e. Produce a control assessment report that document the results of the assessment; and
f. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-2 > CA-2(1) > Discussion

CA-2(1) Independent Assessors - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-2 Control Assessments

Independent assessors or assessment teams are individuals or groups who conduct impartial assessments of systems. Impartiality means that assessors are free from any perceived or actual conflicts of interest regarding the development, operation, sustainment, or management of the systems under assessment or the determination of control effectiveness. To achieve impartiality, assessors do not create a mutual or conflicting interest with the organizations where the assessments are being conducted, assess their own work, act as management or employees of the organizations they are serving, or place themselves in positions of advocacy for the organizations acquiring their services.

Independent assessments can be obtained from elements within organizations or be contracted to public or private sector entities outside of organizations. Authorizing officials determine the required level of independence based on the security categories of systems and/or the risk to organizational operations, organizational assets, or individuals. Authorizing officials also determine if the level of assessor independence provides sufficient assurance that the results are sound and can be used to make credible, risk-based decisions. Assessor independence determination includes whether contracted assessment services have sufficient independence, such as when system owners are not directly involved in contracting processes or cannot influence the impartiality of the assessors conducting the assessments. During the system design and development phase, having independent assessors is analogous to having independent SMEs involved in design reviews.

When organizations that own the systems are small or the structures of the organizations require that assessments be conducted by individuals that are in the developmental, operational, or management chain of the system owners, independence in assessment processes can be achieved by ensuring that assessment results are carefully reviewed and analyzed by independent teams of experts to validate the completeness, accuracy, integrity, and reliability of the results. Assessments performed for purposes other than to support authorization decisions are more likely to be useable for such decisions when performed by assessors with sufficient independence, thereby reducing the need to repeat assessments.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-2 > CA-2(1)

CA-2(1) Control Assessments | Independent Assessors
Family: Assessment, Authorization, and Monitoring (CA) > CA-2 Control Assessments

Employ independent assessors or assessment teams to conduct control assessments.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-2 > CA-2(2) > Discussion

CA-2(2) Specialized Assessments - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-2 Control Assessments

Organizations can conduct specialized assessments, including verification and validation, system monitoring, insider threat assessments, malicious user testing, and other forms of testing. These assessments can improve readiness by exercising organizational capabilities and indicating current levels of performance as a means of focusing actions to improve security and privacy. Organizations conduct specialized assessments in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Authorizing officials approve the assessment methods in coordination with the organizational risk executive function. Organizations can include vulnerabilities uncovered during assessments into vulnerability remediation processes. Specialized assessments can also be conducted early in the system development life cycle (e.g., during initial design, development, and unit testing).
Security and Privacy Controls for Information Systems and Organizations
CA > CA-2 > CA-2(2)

CA-2(2) Control Assessments | Specialized Assessments
Family: Assessment, Authorization, and Monitoring (CA) > CA-2 Control Assessments

Include as part of control assessments, [Assignment: organization-defined specialized assessment frequency], [Selection: announced; unannounced], [Selection; one or more: in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment] ].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-2 > CA-2(3) > Discussion

CA-2(3) Leveraging Results from External Organizations - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-2 Control Assessments

Organizations may rely on control assessments of organizational systems by other (external) organizations. Using such assessments and reusing existing assessment evidence can decrease the time and resources required for assessments by limiting the independent assessment activities that organizations need to perform. The factors that organizations consider in determining whether to accept assessment results from external organizations can vary. Such factors include the organization's past experience with the organization that conducted the assessment, the reputation of the assessment organization, the level of detail of supporting assessment evidence provided, and mandates imposed by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Accredited testing laboratories that support the Common Criteria Program [ISO 15408-1](#6afc1b04-c9d6-4023-adbc-f8fbe33a3c73) , the NIST Cryptographic Module Validation Program (CMVP), or the NIST Cryptographic Algorithm Validation Program (CAVP) can provide independent assessment results that organizations can leverage.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-2 > CA-2(3)

CA-2(3) Control Assessments | Leveraging Results from External Organizations
Family: Assessment, Authorization, and Monitoring (CA) > CA-2 Control Assessments

Leverage the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-3

CA-3 Information Exchange
Family: Assessment, Authorization, and Monitoring (CA)

a. Approve and manage the exchange of information between the system and other systems using [Selection; one or more: interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: organization-defined type of agreement] ];
b. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and
c. Review and update the agreements [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-3 > Discussion

CA-3 Information Exchange - Discussion
Family: Assessment, Authorization, and Monitoring (CA)

System information exchange requirements apply to information exchanges between two or more systems. System information exchanges include connections via leased lines or virtual private networks, connections to internet service providers, database sharing or exchanges of database transaction information, connections and exchanges with cloud services, exchanges via web-based services, or exchanges of files via file transfer protocols, network protocols (e.g., IPv4, IPv6), email, or other organization-to-organization communications. Organizations consider the risk related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security and privacy requirements and controls. This includes systems within the same organization and systems that are external to the organization. A joint authorization of the systems exchanging information, as described in [CA-6(1)](#ca-6.1) or [CA-6(2)](#ca-6.2) , may help to communicate and reduce risk.

Authorizing officials determine the risk associated with system information exchange and the controls needed for appropriate risk mitigation. The types of agreements selected are based on factors such as the impact level of the information being exchanged, the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual), or the level of access to the organizational system by users of the other system. If systems that exchange information have the same authorizing official, organizations need not develop agreements. Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from [CA-3a](#ca-3_smt.a) in the respective security and privacy plans for the systems. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (including service providers, contractors, system developers, and system integrators). Risk considerations include systems that share the same networks.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-3 > CA-3(6) > Discussion

CA-3(6) Transfer Authorizations - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-3 Information Exchange

To prevent unauthorized individuals and systems from making information transfers to protected systems, the protected system verifies-via independent means- whether the individual or system attempting to transfer information is authorized to do so. Verification of the authorization to transfer information also applies to control plane traffic (e.g., routing and DNS) and services (e.g., authenticated SMTP relays).
Security and Privacy Controls for Information Systems and Organizations
CA > CA-3 > CA-3(6)

CA-3(6) Information Exchange | Transfer Authorizations
Family: Assessment, Authorization, and Monitoring (CA) > CA-3 Information Exchange

Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-3 > CA-3(7) > Discussion

CA-3(7) Transitive Information Exchanges - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-3 Information Exchange

Transitive or "downstream" information exchanges are information exchanges between the system or systems with which the organizational system exchanges information and other systems. For mission-essential systems, services, and applications, including high value assets, it is necessary to identify such information exchanges. The transparency of the controls or protection measures in place in such downstream systems connected directly or indirectly to organizational systems is essential to understanding the security and privacy risks resulting from those information exchanges. Organizational systems can inherit risk from downstream systems through transitive connections and information exchanges, which can make the organizational systems more susceptible to threats, hazards, and adverse impacts.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-3 > CA-3(7)

CA-3(7) Information Exchange | Transitive Information Exchanges
Family: Assessment, Authorization, and Monitoring (CA) > CA-3 Information Exchange

(a) Identify transitive (downstream) information exchanges with other systems through the systems identified in [CA-3a](#ca-3_smt.a) ; and
(b) Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-5

CA-5 Plan of Action and Milestones
Family: Assessment, Authorization, and Monitoring (CA)

a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
b. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-5 > Discussion

CA-5 Plan of Action and Milestones - Discussion
Family: Assessment, Authorization, and Monitoring (CA)

Plans of action and milestones are useful for any type of organization to track planned remedial actions. Plans of action and milestones are required in authorization packages and subject to federal reporting requirements established by OMB.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-5 > CA-5(1) > Discussion

CA-5(1) Automation Support for Accuracy and Currency - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-5 Plan of Action and Milestones

Using automated tools helps maintain the accuracy, currency, and availability of the plan of action and milestones and facilitates the coordination and sharing of security and privacy information throughout the organization. Such coordination and information sharing help to identify systemic weaknesses or deficiencies in organizational systems and ensure that appropriate resources are directed at the most critical system vulnerabilities in a timely manner.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-5 > CA-5(1)

CA-5(1) Plan of Action and Milestones | Automation Support for Accuracy and Currency
Family: Assessment, Authorization, and Monitoring (CA) > CA-5 Plan of Action and Milestones

Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-6

CA-6 Authorization
Family: Assessment, Authorization, and Monitoring (CA)

a. Assign a senior official as the authorizing official for the system;
b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;
c. Ensure that the authorizing official for the system, before commencing operations:
1. Accepts the use of common controls inherited by the system; and
2. Authorizes the system to operate;
d. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
e. Update the authorizations [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-6 > Discussion

CA-6 Authorization - Discussion
Family: Assessment, Authorization, and Monitoring (CA)

Authorizations are official management decisions by senior officials to authorize operation of systems, authorize the use of common controls for inheritance by organizational systems, and explicitly accept the risk to organizational operations and assets, individuals, other organizations, and the Nation based on the implementation of agreed-upon controls. Authorizing officials provide budgetary oversight for organizational systems and common controls or assume responsibility for the mission and business functions supported by those systems or common controls. The authorization process is a federal responsibility, and therefore, authorizing officials must be federal employees. Authorizing officials are both responsible and accountable for security and privacy risks associated with the operation and use of organizational systems. Nonfederal organizations may have similar processes to authorize systems and senior officials that assume the authorization role and associated responsibilities.

Authorizing officials issue ongoing authorizations of systems based on evidence produced from implemented continuous monitoring programs. Robust continuous monitoring programs reduce the need for separate reauthorization processes. Through the employment of comprehensive continuous monitoring processes, the information contained in authorization packages (i.e., security and privacy plans, assessment reports, and plans of action and milestones) is updated on an ongoing basis. This provides authorizing officials, common control providers, and system owners with an up-to-date status of the security and privacy posture of their systems, controls, and operating environments. To reduce the cost of reauthorization, authorizing officials can leverage the results of continuous monitoring processes to the maximum extent possible as the basis for rendering reauthorization decisions.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-6 > CA-6(1) > Discussion

CA-6(1) Joint Authorization - Intra-organization - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-6 Authorization

Assigning multiple authorizing officials from the same organization to serve as co-authorizing officials for the system increases the level of independence in the risk-based decision-making process. It also implements the concepts of separation of duties and dual authorization as applied to the system authorization process. The intra-organization joint authorization process is most relevant for connected systems, shared systems, and systems with multiple information owners.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-6 > CA-6(1)

CA-6(1) Authorization | Joint Authorization - Intra-organization
Family: Assessment, Authorization, and Monitoring (CA) > CA-6 Authorization

Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-6 > CA-6(2) > Discussion

CA-6(2) Joint Authorization - Inter-organization - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-6 Authorization

Assigning multiple authorizing officials, at least one of whom comes from an external organization, to serve as co-authorizing officials for the system increases the level of independence in the risk-based decision-making process. It implements the concepts of separation of duties and dual authorization as applied to the system authorization process. Employing authorizing officials from external organizations to supplement the authorizing official from the organization that owns or hosts the system may be necessary when the external organizations have a vested interest or equities in the outcome of the authorization decision. The inter-organization joint authorization process is relevant and appropriate for connected systems, shared systems or services, and systems with multiple information owners. The authorizing officials from the external organizations are key stakeholders of the system undergoing authorization.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-6 > CA-6(2)

CA-6(2) Authorization | Joint Authorization - Inter-organization
Family: Assessment, Authorization, and Monitoring (CA) > CA-6 Authorization

Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.