ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(1) > Discussion

RA-3(1) Supply Chain Risk Assessment - Discussion
Family: Risk Assessment (RA) > RA-3 Risk Assessment

Supply chain-related events include disruption, use of defective components, insertion of counterfeits, theft, malicious development practices, improper delivery practices, and insertion of malicious code. These events can have a significant impact on the confidentiality, integrity, or availability of a system and its information and, therefore, can also adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. The supply chain-related events may be unintentional or malicious and can occur at any point during the system life cycle. An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(1)

RA-3(1) Risk Assessment | Supply Chain Risk Assessment
Family: Risk Assessment (RA) > RA-3 Risk Assessment

(a) Assess supply chain risks associated with [Assignment: organization-defined systems, system components, and system services] ; and
(b) Update the supply chain risk assessment [Assignment: organization-defined frequency] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(2) > Discussion

RA-3(2) Use of All-source Intelligence - Discussion
Family: Risk Assessment (RA) > RA-3 Risk Assessment

Organizations employ all-source intelligence to inform engineering, acquisition, and risk management decisions. All-source intelligence consists of information derived from all available sources, including publicly available or open-source information, measurement and signature intelligence, human intelligence, signals intelligence, and imagery intelligence. All-source intelligence is used to analyze the risk of vulnerabilities (both intentional and unintentional) from development, manufacturing, and delivery processes, people, and the environment. The risk analysis may be performed on suppliers at multiple tiers in the supply chain sufficient to manage risks. Organizations may develop agreements to share all-source intelligence information or resulting decisions with other organizations, as appropriate.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(2)

RA-3(2) Risk Assessment | Use of All-source Intelligence
Family: Risk Assessment (RA) > RA-3 Risk Assessment

Use all-source intelligence to assist in the analysis of risk.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(3) > Discussion

RA-3(3) Dynamic Threat Awareness - Discussion
Family: Risk Assessment (RA) > RA-3 Risk Assessment

The threat awareness information that is gathered feeds into the organization's information security operations to ensure that procedures are updated in response to the changing threat environment. For example, at higher threat levels, organizations may change the privilege or authentication thresholds required to perform certain operations.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(3)

RA-3(3) Risk Assessment | Dynamic Threat Awareness
Family: Risk Assessment (RA) > RA-3 Risk Assessment

Determine the current cyber threat environment on an ongoing basis using [Assignment: organization-defined means].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(4) > Discussion

RA-3(4) Predictive Cyber Analytics - Discussion
Family: Risk Assessment (RA) > RA-3 Risk Assessment

A properly resourced Security Operations Center (SOC) or Computer Incident Response Team (CIRT) may be overwhelmed by the volume of information generated by the proliferation of security tools and appliances unless it employs advanced automation and analytics to analyze the data. Advanced automation and analytics capabilities are typically supported by artificial intelligence concepts, including machine learning. Examples include Automated Threat Discovery and Response (which includes broad-based collection, context-based analysis, and adaptive response capabilities), automated workflow operations, and machine assisted decision tools. Note, however, that sophisticated adversaries may be able to extract information related to analytic parameters and retrain the machine learning to classify malicious activity as benign. Accordingly, machine learning is augmented by human monitoring to ensure that sophisticated adversaries are not able to conceal their activities.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-3 > RA-3(4)

RA-3(4) Risk Assessment | Predictive Cyber Analytics
Family: Risk Assessment (RA) > RA-3 Risk Assessment

Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined organization-defined advanced automation and analytics capabilities].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5

RA-5 Vulnerability Monitoring and Scanning
Family: Risk Assessment (RA)

a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyze vulnerability scan reports and results from vulnerability monitoring;
d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;
e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and
f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(2) > Discussion

RA-5(2) Update Vulnerabilities to Be Scanned - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Due to the complexity of modern software, systems, and other factors, new vulnerabilities are discovered on a regular basis. It is important that newly discovered vulnerabilities are added to the list of vulnerabilities to be scanned to ensure that the organization can take steps to mitigate those vulnerabilities in a timely manner.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(2)

RA-5(2) Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Update the system vulnerabilities to be scanned [Selection; one or more: [Assignment: organization-defined frequency] ; prior to a new scan; when new vulnerabilities are identified and reported].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(3) > Discussion

RA-5(3) Breadth and Depth of Coverage - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

The breadth of vulnerability scanning coverage can be expressed as a percentage of components within the system, by the particular types of systems, by the criticality of systems, or by the number of vulnerabilities to be checked. Conversely, the depth of vulnerability scanning coverage can be expressed as the level of the system design that the organization intends to monitor (e.g., component, module, subsystem, element). Organizations can determine the sufficiency of vulnerability scanning coverage with regard to its risk tolerance and other factors. Scanning tools and how the tools are configured may affect the depth and coverage. Multiple scanning tools may be needed to achieve the desired depth and coverage. [SP 800-53A](#a21aef46-7330-48a0-b2e1-c5bb8b2dd11d) provides additional information on the breadth and depth of coverage.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(3)

RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Define the breadth and depth of vulnerability scanning coverage.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(4) > Discussion

RA-5(4) Discoverable Information - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Discoverable information includes information that adversaries could obtain without compromising or breaching the system, such as by collecting information that the system is exposing or by conducting extensive web searches. Corrective actions include notifying appropriate organizational personnel, removing designated information, or changing the system to make the designated information less relevant or attractive to adversaries. This enhancement excludes intentionally discoverable information that may be part of a decoy capability (e.g., honeypots, honeynets, or deception nets) deployed by the organization.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(4)

RA-5(4) Vulnerability Monitoring and Scanning | Discoverable Information
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(5) > Discussion

RA-5(5) Privileged Access - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

In certain situations, the nature of the vulnerability scanning may be more intrusive, or the system component that is the subject of the scanning may contain classified or controlled unclassified information, such as personally identifiable information. Privileged access authorization to selected system components facilitates more thorough vulnerability scanning and protects the sensitive nature of such scanning.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(5)

RA-5(5) Vulnerability Monitoring and Scanning | Privileged Access
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Implement privileged access authorization to [Assignment: organization-defined system components] for [Assignment: organization-defined vulnerability scanning activities].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(6) > Discussion

RA-5(6) Automated Trend Analyses - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Using automated mechanisms to analyze multiple vulnerability scans over time can help determine trends in system vulnerabilities and identify patterns of attack.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(6)

RA-5(6) Vulnerability Monitoring and Scanning | Automated Trend Analyses
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Compare the results of multiple vulnerability scans using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(8) > Discussion

RA-5(8) Review Historic Audit Logs - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Reviewing historic audit logs to determine if a recently detected vulnerability in a system has been previously exploited by an adversary can provide important information for forensic analyses. Such analyses can help identify, for example, the extent of a previous intrusion, the trade craft employed during the attack, organizational information exfiltrated or modified, mission or business capabilities affected, and the duration of the attack.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(8)

RA-5(8) Vulnerability Monitoring and Scanning | Review Historic Audit Logs
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(10) > Discussion

RA-5(10) Correlate Scanning Information - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

An attack vector is a path or means by which an adversary can gain access to a system in order to deliver malicious code or exfiltrate information. Organizations can use attack trees to show how hostile activities by adversaries interact and combine to produce adverse impacts or negative consequences to systems and organizations. Such information, together with correlated data from vulnerability scanning tools, can provide greater clarity regarding multi-vulnerability and multi-hop attack vectors. The correlation of vulnerability scanning information is especially important when organizations are transitioning from older technologies to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols). During such transitions, some system components may inadvertently be unmanaged and create opportunities for adversary exploitation.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(10)

RA-5(10) Vulnerability Monitoring and Scanning | Correlate Scanning Information
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(11) > Discussion

RA-5(11) Public Disclosure Program - Discussion
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

The reporting channel is publicly discoverable and contains clear language authorizing good-faith research and the disclosure of vulnerabilities to the organization. The organization does not condition its authorization on an expectation of indefinite non-disclosure to the public by the reporting entity but may request a specific time period to properly remediate the vulnerability.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-5 > RA-5(11)

RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program
Family: Risk Assessment (RA) > RA-5 Vulnerability Monitoring and Scanning

Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-6

RA-6 Technical Surveillance Countermeasures Survey
Family: Risk Assessment (RA)

Employ a technical surveillance countermeasures survey at [Assignment: organization-defined locations] [Selection; one or more: [Assignment: organization-defined frequency] ; when [Assignment: organization-defined events or indicators] ].
Security and Privacy Controls for Information Systems and Organizations
RA > RA-6 > Discussion

RA-6 Technical Surveillance Countermeasures Survey - Discussion
Family: Risk Assessment (RA)

A technical surveillance countermeasures survey is a service provided by qualified personnel to detect the presence of technical surveillance devices and hazards and to identify technical security weaknesses that could be used in the conduct of a technical penetration of the surveyed facility. Technical surveillance countermeasures surveys also provide evaluations of the technical security posture of organizations and facilities and include visual, electronic, and physical examinations of surveyed facilities, internally and externally. The surveys also provide useful input for risk assessments and information regarding organizational exposure to potential adversaries.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-7

RA-7 Risk Response
Family: Risk Assessment (RA)

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-7 > Discussion

RA-7 Risk Response - Discussion
Family: Risk Assessment (RA)

Organizations have many options for responding to risk including mitigating risk by implementing new controls or strengthening existing controls, accepting risk with appropriate justification or rationale, sharing or transferring risk, or avoiding risk. The risk tolerance of the organization influences risk response decisions and actions. Risk response addresses the need to determine an appropriate response to risk before generating a plan of action and milestones entry. For example, the response may be to accept risk or reject risk, or it may be possible to mitigate the risk immediately so that a plan of action and milestones entry is not needed. However, if the risk response is to mitigate the risk, and the mitigation cannot be completed immediately, a plan of action and milestones entry is generated.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-8

RA-8 Privacy Impact Assessments
Family: Risk Assessment (RA)

Conduct privacy impact assessments for systems, programs, or other activities before:
a. Developing or procuring information technology that processes personally identifiable information; and
b. Initiating a new collection of personally identifiable information that:
1. Will be processed using information technology; and
2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-8 > Discussion

RA-8 Privacy Impact Assessments - Discussion
Family: Risk Assessment (RA)

A privacy impact assessment is an analysis of how personally identifiable information is handled to ensure that handling conforms to applicable privacy requirements, determine the privacy risks associated with an information system or activity, and evaluate ways to mitigate privacy risks. A privacy impact assessment is both an analysis and a formal document that details the process and the outcome of the analysis.

Organizations conduct and develop a privacy impact assessment with sufficient clarity and specificity to demonstrate that the organization fully considered privacy and incorporated appropriate privacy protections from the earliest stages of the organization's activity and throughout the information life cycle. In order to conduct a meaningful privacy impact assessment, the organization's senior agency official for privacy works closely with program managers, system owners, information technology experts, security officials, counsel, and other relevant organization personnel. Moreover, a privacy impact assessment is not a time-restricted activity that is limited to a particular milestone or stage of the information system or personally identifiable information life cycles. Rather, the privacy analysis continues throughout the system and personally identifiable information life cycles. Accordingly, a privacy impact assessment is a living document that organizations update whenever changes to the information technology, changes to the organization's practices, or other factors alter the privacy risks associated with the use of such information technology.

To conduct the privacy impact assessment, organizations can use security and privacy risk assessments. Organizations may also use other related processes that may have different names, including privacy threshold analyses. A privacy impact assessment can also serve as notice to the public regarding the organization's practices with respect to privacy. Although conducting and publishing privacy impact assessments may be required by law, organizations may develop such policies in the absence of applicable laws. For federal agencies, privacy impact assessments may be required by [EGOV](#7b0b9634-741a-4335-b6fa-161228c3a76e) ; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision.
Security and Privacy Controls for Information Systems and Organizations
RA > RA-9

RA-9 Criticality Analysis
Family: Risk Assessment (RA)

Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle].