ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-22 > Assessment Methods

SA-22 Unsupported System Components - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the replacement or continued use of unsupported system components

documented evidence of replacing unsupported system components

documented approvals (including justification) for the continued use of unsupported system components

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with the responsibility for the system development life cycle

organizational personnel responsible for component replacement

Test: Organizational processes for replacing unsupported system components

mechanisms supporting and/or implementing the replacement of unsupported system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-22 > Assessment Objective

SA-22 Unsupported System Components - Assessment Objective
Determine if the following are satisfied:

SA-22a. system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer;
SA-22b. [Selection; one or more: in-house support; [Assignment: organization-defined support from external providers] ] provide options for alternative sources for continued support for unsupported components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-23 > Assessment Methods

SA-23 Specialization - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing design modification, augmentation, or reconfiguration of systems or system components

documented evidence of design modification, augmentation, or reconfiguration

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with the responsibility for security architecture

organizational personnel responsible for configuration management

Test: Organizational processes for the modification of design, augmentation, or reconfiguration of systems or system components

mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-23 > Assessment Objective

SA-23 Specialization - Assessment Objective
Determine if the following are satisfied:

[Selection; one or more: design modification; augmentation; reconfiguration] is employed on [Assignment: organization-defined systems or system components] supporting essential services or functions to increase the trustworthiness in those systems or components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-24 > Assessment Methods

SA-24 Design For Cyber Resiliency - Assessment Methods and Objects

Examine: System and services acquisition policy;

system and services acquisition procedures;

assessment and authorization procedures;

procedures addressing cyber resiliency goals, objectives, techniques, implementation approaches, and design principles used in the specification, design, development, implementation, and modification of the system;

system design documentation;

security and privacy requirements and specifications for the system;

system security plan;

privacy plan;

privacy impact assessment;

privacy risk assessment documentation.

Interview: Organizational personnel with acquisition/contracting responsibilities;

organizational personnel with information security and privacy responsibilities;

organizational personnel with system specification, design, development, implementation, and modification responsibilities;

system developers.

Test: Organizational processes for applying cyber resiliency principles in system specification, design, development, implementation, and modification;

mechanisms supporting the application of cyber resiliency principles in system specification, design, development, implementation, and modification.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-24 > Assessment Objective

SA-24 Design For Cyber Resiliency - Assessment Objective
Determine if the following are satisfied:

Determine if:
SA-24a.01 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency goals];
SA-24a.02 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency objectives];
SA-24a.03 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency techniques];
SA-24a.04 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency implementation approaches];
SA-24a.05 organizational systems, system components, or system services achieve cyber resiliency through [Assignment: organization-defined cyber resiliency design principles];
SA-24b.[01] selected cyber resiliency goals are implemented as part of an organizational risk management process of systems security engineering process;
SA-24b.[02] selected cyber resiliency objectives are implemented as part of an organizational risk management process of systems security engineering process;
SA-24b.[03] selected cyber resiliency techniques are implemented as part of an organizational risk management process of systems security engineering process;
SA-24b.[04] selected cyber resiliency implementation approaches are implemented as part of an organizational risk management process of systems security engineering process;
SA-24b.[05] selected cyber resiliency design principles are implemented as part of an organizational risk management process of systems security engineering process.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-1 > Assessment Methods

SC-1 Policy and Procedures - Assessment Methods and Objects

Examine: System and communications protection policy

system and communications protection procedures

system security plan

privacy plan

risk management strategy documentation

audit findings

other relevant documents or records

Interview: Organizational personnel with system and communications protection responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-1 > Assessment Objective

SC-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

SC-01a.[01] a system and communications protection policy is developed and documented;
SC-01a.[02] the system and communications protection policy is disseminated to [Assignment: organization-defined personnel or roles];
SC-01a.[03] system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented;
SC-01a.[04] the system and communications protection procedures are disseminated to [Assignment: organization-defined personnel or roles];
SC-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy addresses purpose;
SC-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy addresses scope;
SC-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy addresses roles;
SC-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy addresses responsibilities;
SC-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy addresses management commitment;
SC-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy addresses coordination among organizational entities;
SC-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy addresses compliance;
SC-01a.01(b) the [Selection; one or more: organization-level; mission/business-process-level; system-level] system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
SC-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures;
SC-01c.01[01] the current system and communications protection policy is reviewed and updated [Assignment: organization-defined frequency];
SC-01c.01[02] the current system and communications protection policy is reviewed and updated following [Assignment: organization-defined events];
SC-01c.02[01] the current system and communications protection procedures are reviewed and updated [Assignment: organization-defined frequency];
SC-01c.02[02] the current system and communications protection procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-2 > Assessment Methods

SC-2 Separation of System and User Functionality - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing application partitioning

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Separation of user functionality from system management functionality
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-2 > Assessment Objective

SC-2 Separation of System and User Functionality - Assessment Objective
Determine if the following are satisfied:

user functionality, including user interface services, is separated from system management functionality.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-2 > SC-2(1) > Assessment Methods

SC-2(1) Interfaces for Non-privileged Users - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing application partitioning

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

non-privileged users of the system

system developer

Test: Separation of user functionality from system management functionality
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-2 > SC-2(1) > Assessment Objective

SC-2(1) Interfaces for Non-privileged Users - Assessment Objective
Determine if the following are satisfied:

the presentation of system management functionality is prevented at interfaces to non-privileged users.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-2 > SC-2(2) > Assessment Methods

SC-2(2) Disassociability - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing application and software partitioning

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developer

Test: Separation of application state information from software
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-2 > SC-2(2) > Assessment Objective

SC-2(2) Disassociability - Assessment Objective
Determine if the following are satisfied:

state information is stored separately from applications and software.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > Assessment Methods

SC-3 Security Function Isolation - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing security function isolation

list of security functions to be isolated from non-security functions

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Separation of security functions from non-security functions within the system
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > Assessment Objective

SC-3 Security Function Isolation - Assessment Objective
Determine if the following are satisfied:

security functions are isolated from non-security functions.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(1) > Assessment Methods

SC-3(1) Hardware Separation - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing security function isolation

system design documentation

hardware separation mechanisms

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Separation of security functions from non-security functions within the system
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(1) > Assessment Objective

SC-3(1) Hardware Separation - Assessment Objective
Determine if the following are satisfied:

hardware separation mechanisms are employed to implement security function isolation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(2) > Assessment Methods

SC-3(2) Access and Flow Control Functions - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing security function isolation

list of critical security functions

system design documentation

system configuration settings and associated documentation

system audit records system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Isolation of security functions enforcing access and information flow control
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(2) > Assessment Objective

SC-3(2) Access and Flow Control Functions - Assessment Objective
Determine if the following are satisfied:

SC-03(02)[01] security functions enforcing access control are isolated from non-security functions;
SC-03(02)[02] security functions enforcing access control are isolated from other security functions;
SC-03(02)[03] security functions enforcing information flow control are isolated from non-security functions;
SC-03(02)[04] security functions enforcing information flow control are isolated from other security functions.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(3) > Assessment Methods

SC-3(3) Minimize Nonsecurity Functionality - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing security function isolation

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing an isolation boundary
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(3) > Assessment Objective

SC-3(3) Minimize Nonsecurity Functionality - Assessment Objective
Determine if the following are satisfied:

the number of non-security functions included within the isolation boundary containing security functions is minimized.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(4) > Assessment Methods

SC-3(4) Module Coupling and Cohesiveness - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing security function isolation

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Organizational processes for maximizing internal cohesiveness within modules and minimizing coupling between modules

mechanisms supporting and/or implementing security functions as independent modules
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(4) > Assessment Objective

SC-3(4) Module Coupling and Cohesiveness - Assessment Objective
Determine if the following are satisfied:

SC-03(04)[01] security functions are implemented as largely independent modules that maximize internal cohesiveness within modules;
SC-03(04)[02] security functions are implemented as largely independent modules that minimize coupling between modules.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(5) > Assessment Methods

SC-3(5) Layered Structures - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing security function isolation

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Organizational processes for implementing security functions as a layered structure that minimizes interactions between layers and avoids dependence by lower layers on functionality/correctness of higher layers

mechanisms supporting and/or implementing security functions as a layered structure
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-3 > SC-3(5) > Assessment Objective

SC-3(5) Layered Structures - Assessment Objective
Determine if the following are satisfied:

security functions are implemented as a layered structure, minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-4 > Assessment Methods

SC-4 Information in Shared System Resources - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing information protection in shared system resources

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms preventing the unauthorized and unintended transfer of information via shared system resources
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-4 > Assessment Objective

SC-4 Information in Shared System Resources - Assessment Objective
Determine if the following are satisfied:

SC-04[01] unauthorized information transfer via shared system resources is prevented;
SC-04[02] unintended information transfer via shared system resources is prevented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-4 > SC-4(2) > Assessment Methods

SC-4(2) Multilevel or Periods Processing - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing information protection in shared system resources

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms preventing the unauthorized transfer of information via shared system resources
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-4 > SC-4(2) > Assessment Objective

SC-4(2) Multilevel or Periods Processing - Assessment Objective
Determine if the following are satisfied:

unauthorized information transfer via shared resources is prevented in accordance with [Assignment: organization-defined procedures] when system processing explicitly switches between different information classification levels or security categories.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > Assessment Methods

SC-5 Denial-of-service Protection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing denial-of-service protection

system design documentation

list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks

list of security safeguards protecting against or limiting the effects of denial-of-service attacks

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with incident response responsibilities

system developer

Test: Mechanisms protecting against or limiting the effects of denial-of-service attacks
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-5 > Assessment Objective

SC-5 Denial-of-service Protection - Assessment Objective
Determine if the following are satisfied:

SC-05a. the effects of [Assignment: organization-defined types of denial-of-service events] are [Selection: protect against; limit];
SC-05b. [Assignment: organization-defined controls by type of denial-of-service event] are employed to achieve the denial-of-service protection objective.