ezesecops/rmf-ato-core huggingface dataset:
Control Baselines for Information Systems and Organizations — MODERATE baseline
SP 800-53B Baselines > MODERATE

SP 800-53B MODERATE baseline. Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 MODERATE IMPACT BASELINE. The MODERATE baseline selects 287 controls and control enhancements (177 base controls, 110 enhancements) from the SP 800-53 Rev 5 catalog. Selected control identifiers:

AC-1, AC-2, AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-2(5), AC-2(13), AC-3, AC-4, AC-5, AC-6, AC-6(1), AC-6(2), AC-6(5), AC-6(7), AC-6(9), AC-6(10), AC-7, AC-8, AC-11, AC-11(1), AC-12, AC-14, AC-17, AC-17(1), AC-17(2), AC-17(3), AC-17(4), AC-18, AC-18(1), AC-18(3), AC-19, AC-19(5), AC-20, AC-20(1), AC-20(2), AC-21, AC-22, AT-1, AT-2, AT-2(2), AT-2(3), AT-3, AT-4, AU-1, AU-2, AU-3, AU-3(1), AU-4, AU-5, AU-6, AU-6(1), AU-6(3), AU-7, AU-7(1), AU-8, AU-9, AU-9(4), AU-11, AU-12, CA-1, CA-2, CA-2(1), CA-3, CA-5, CA-6, CA-7, CA-7(1), CA-7(4), CA-9, CM-1, CM-2, CM-2(2), CM-2(3), CM-2(7), CM-3, CM-3(2), CM-3(4), CM-4, CM-4(2), CM-5, CM-6, CM-7, CM-7(1), CM-7(2), CM-7(5), CM-8, CM-8(1), CM-8(3), CM-9, CM-10, CM-11, CM-12, CM-12(1), CP-1, CP-2, CP-2(1), CP-2(3), CP-2(8), CP-3, CP-4, CP-4(1), CP-6, CP-6(1), CP-6(3), CP-7, CP-7(1), CP-7(2), CP-7(3), CP-8, CP-8(1), CP-8(2), CP-9, CP-9(1), CP-9(8), CP-10, CP-10(2), IA-1, IA-2, IA-2(1), IA-2(2), IA-2(8), IA-2(12), IA-3, IA-4, IA-4(4), IA-5, IA-5(1), IA-5(2), IA-5(6), IA-6, IA-7, IA-8, IA-8(1), IA-8(2), IA-8(4), IA-11, IA-12, IA-12(2), IA-12(3), IA-12(5), IR-1, IR-2, IR-3, IR-3(2), IR-4, IR-4(1), IR-5, IR-6, IR-6(1), IR-6(3), IR-7, IR-7(1), IR-8, MA-1, MA-2, MA-3, MA-3(1), MA-3(2), MA-3(3), MA-4, MA-5, MA-6, MP-1, MP-2, MP-3, MP-4, MP-5, MP-6, MP-7, PE-1, PE-2, PE-3, PE-4, PE-5, PE-6, PE-6(1), PE-8, PE-9, PE-10, PE-11, PE-12, PE-13, PE-13(1), PE-14, PE-15, PE-16, PE-17, PL-1, PL-2, PL-4, PL-4(1), PL-8, PL-10, PL-11, PS-1, PS-2, PS-3, PS-4, PS-5, PS-6, PS-7, PS-8, PS-9, RA-1, RA-2, RA-3, RA-3(1), RA-5, RA-5(2), RA-5(5), RA-5(11), RA-7, RA-9, SA-1, SA-2, SA-3, SA-4, SA-4(1), SA-4(2), SA-4(9), SA-4(10), SA-5, SA-8, SA-9, SA-9(2), SA-10, SA-11, SA-15, SA-15(3), SA-22, SC-1, SC-2, SC-4, SC-5, SC-7, SC-7(3), SC-7(4), SC-7(5), SC-7(7), SC-7(8), SC-8, SC-8(1), SC-10, SC-12, SC-13, SC-15, SC-17, SC-18, SC-20, SC-21, SC-22, SC-23, SC-28, SC-28(1), SC-39, SI-1, SI-2, SI-2(2), SI-3, SI-4, SI-4(2), SI-4(4), SI-4(5), SI-5, SI-7, SI-7(1), SI-7(7), SI-8, SI-8(2), SI-10, SI-11, SI-12, SI-16, SR-1, SR-2, SR-2(1), SR-3, SR-5, SR-6, SR-8, SR-10, SR-11, SR-11(1), SR-11(2), SR-12
Control Baselines for Information Systems and Organizations — PRIVACY baseline
SP 800-53B Baselines > PRIVACY

SP 800-53B PRIVACY baseline. Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 PRIVACY BASELINE. The PRIVACY baseline selects 96 controls and control enhancements (75 base controls, 21 enhancements) from the SP 800-53 Rev 5 catalog. Selected control identifiers:

AC-1, AC-3(14), AT-1, AT-2, AT-3, AT-3(5), AT-4, AU-1, AU-2, AU-3(3), AU-11, CA-1, CA-2, CA-5, CA-6, CA-7, CA-7(4), CM-1, CM-4, IR-1, IR-2, IR-2(3), IR-3, IR-4, IR-5, IR-6, IR-7, IR-8, IR-8(1), MP-1, MP-6, PE-8(3), PL-1, PL-2, PL-4, PL-4(1), PL-8, PL-9, PM-3, PM-4, PM-5(1), PM-6, PM-7, PM-8, PM-9, PM-10, PM-11, PM-13, PM-14, PM-17, PM-18, PM-19, PM-20, PM-20(1), PM-21, PM-22, PM-24, PM-25, PM-26, PM-27, PM-28, PM-31, PS-6, PT-1, PT-2, PT-3, PT-4, PT-5, PT-5(2), PT-6, PT-6(1), PT-6(2), PT-7, PT-7(1), PT-7(2), PT-8, RA-1, RA-3, RA-7, RA-8, SA-1, SA-2, SA-3, SA-4, SA-8(33), SA-9, SA-11, SC-7(24), SI-1, SI-12, SI-12(1), SI-12(2), SI-12(3), SI-18, SI-18(4), SI-19
Security and Privacy Controls for Information Systems and Organizations
AC > AC-1

AC-1 Policy and Procedures
Family: Access Control (AC)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the access control policy and the associated access controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the access control policy and procedures; and
c. Review and update the current access control:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-1 > Discussion

AC-1 Policy and Procedures - Discussion
Family: Access Control (AC)

Access control policy and procedures address the controls in the AC family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of access control policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies reflecting the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to access control policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2

AC-2 Account Management
Family: Access Control (AC)

a. Define and document the types of accounts allowed and specifically prohibited for use within the system;
b. Assign account managers;
c. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership;
d. Specify:
1. Authorized users of the system;
2. Group and role membership; and
3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account;
e. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts;
f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];
g. Monitor the use of accounts;
h. Notify account managers and [Assignment: organization-defined personnel or roles] within:
1. [Assignment: organization-defined time period] when accounts are no longer required;
2. [Assignment: organization-defined time period] when users are terminated or transferred; and
3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual;
i. Authorize access to the system based on:
1. A valid access authorization;
2. Intended system usage; and
3. [Assignment: organization-defined attributes (as required)];
j. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency];
k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
l. Align account management processes with personnel termination and transfer processes.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > Discussion

AC-2 Account Management - Discussion
Family: Access Control (AC)

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts.

Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability.

Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(1) > Discussion

AC-2(1) Automated System Account Management - Discussion
Family: Access Control (AC) > AC-2 Account Management

Automated system account management includes using automated mechanisms to create, enable, modify, disable, and remove accounts; notify account managers when an account is created, enabled, modified, disabled, or removed, or when users are terminated or transferred; monitor system account usage; and report atypical system account usage. Automated mechanisms can include internal system functions and email, telephonic, and text messaging notifications.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(1)

AC-2(1) Account Management | Automated System Account Management
Family: Access Control (AC) > AC-2 Account Management

Support the management of system accounts using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(2) > Discussion

AC-2(2) Automated Temporary and Emergency Account Management - Discussion
Family: Access Control (AC) > AC-2 Account Management

Management of temporary and emergency accounts includes the removal or disabling of such accounts automatically after a predefined time period rather than at the convenience of the system administrator. Automatic removal or disabling of accounts provides a more consistent implementation.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(2)

AC-2(2) Account Management | Automated Temporary and Emergency Account Management
Family: Access Control (AC) > AC-2 Account Management

Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(3) > Discussion

AC-2(3) Disable Accounts - Discussion
Family: Access Control (AC) > AC-2 Account Management

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(3)

AC-2(3) Account Management | Disable Accounts
Family: Access Control (AC) > AC-2 Account Management

Disable accounts within [Assignment: organization-defined time period] when the accounts:
(a) Have expired;
(b) Are no longer associated with a user or individual;
(c) Are in violation of organizational policy; or
(d) Have been inactive for [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(4) > Discussion

AC-2(4) Automated Audit Actions - Discussion
Family: Access Control (AC) > AC-2 Account Management

Account management audit records are defined in accordance with [AU-02](#au-2) and reviewed, analyzed, and reported in accordance with [AU-06](#au-6).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(4)

AC-2(4) Account Management | Automated Audit Actions
Family: Access Control (AC) > AC-2 Account Management

Automatically audit account creation, modification, enabling, disabling, and removal actions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(5) > Discussion

AC-2(5) Inactivity Logout - Discussion
Family: Access Control (AC) > AC-2 Account Management

Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by [AC-11](#ac-11).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(5)

AC-2(5) Account Management | Inactivity Logout
Family: Access Control (AC) > AC-2 Account Management

Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(6) > Discussion

AC-2(6) Dynamic Privilege Management - Discussion
Family: Access Control (AC) > AC-2 Account Management

In contrast to access control approaches that employ static accounts and predefined user privileges, dynamic access control approaches rely on runtime access control decisions facilitated by dynamic privilege management, such as attribute-based access control. While user identities remain relatively constant over time, user privileges typically change more frequently based on ongoing mission or business requirements and the operational needs of organizations. An example of dynamic privilege management is the immediate revocation of privileges from users as opposed to requiring that users terminate and restart their sessions to reflect changes in privileges. Dynamic privilege management can also include mechanisms that change user privileges based on dynamic rules as opposed to editing specific user profiles. Examples include automatic adjustments of user privileges if they are operating out of their normal work times, if their job function or assignment changes, or if systems are under duress or in emergency situations. Dynamic privilege management includes the effects of privilege changes, for example, when there are changes to encryption keys used for communications.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(6)

AC-2(6) Account Management | Dynamic Privilege Management
Family: Access Control (AC) > AC-2 Account Management

Implement [Assignment: organization-defined dynamic privilege management capabilities].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(7) > Discussion

AC-2(7) Privileged User Accounts - Discussion
Family: Access Control (AC) > AC-2 Account Management

Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Privileged roles include key management, account management, database administration, system and network administration, and web administration. A role-based access scheme organizes permitted system access and privileges into roles. In contrast, an attribute-based access scheme specifies allowed system access and privileges based on attributes.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(7)

AC-2(7) Account Management | Privileged User Accounts
Family: Access Control (AC) > AC-2 Account Management

(a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme];
(b) Monitor privileged role or attribute assignments;
(c) Monitor changes to roles or attributes; and
(d) Revoke access when privileged role or attribute assignments are no longer appropriate.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(8) > Discussion

AC-2(8) Dynamic Account Management - Discussion
Family: Access Control (AC) > AC-2 Account Management

Approaches for dynamically creating, activating, managing, and deactivating system accounts rely on automatically provisioning the accounts at runtime for entities that were previously unknown. Organizations plan for the dynamic management, creation, activation, and deactivation of system accounts by establishing trust relationships, business rules, and mechanisms with appropriate authorities to validate related authorizations and privileges.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(8)

AC-2(8) Account Management | Dynamic Account Management
Family: Access Control (AC) > AC-2 Account Management

Create, activate, manage, and deactivate [Assignment: organization-defined system accounts] dynamically.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(9) > Discussion

AC-2(9) Restrictions on Use of Shared and Group Accounts - Discussion
Family: Access Control (AC) > AC-2 Account Management

Before permitting the use of shared or group accounts, organizations consider the increased risk due to the lack of accountability with such accounts.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(9)

AC-2(9) Account Management | Restrictions on Use of Shared and Group Accounts
Family: Access Control (AC) > AC-2 Account Management

Only permit the use of shared and group accounts that meet [Assignment: organization-defined conditions].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(11) > Discussion

AC-2(11) Usage Conditions - Discussion
Family: Access Control (AC) > AC-2 Account Management

Specifying and enforcing usage conditions helps to enforce the principle of least privilege, increase user accountability, and enable effective account monitoring. Account monitoring includes alerts generated if the account is used in violation of organizational parameters. Organizations can describe specific conditions or circumstances under which system accounts can be used, such as by restricting usage to certain days of the week, time of day, or specific durations of time.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(11)

AC-2(11) Account Management | Usage Conditions
Family: Access Control (AC) > AC-2 Account Management

Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(12) > Discussion

AC-2(12) Account Monitoring for Atypical Usage - Discussion
Family: Access Control (AC) > AC-2 Account Management

Atypical usage includes accessing systems at certain times of the day or from locations that are not consistent with the normal usage patterns of individuals. Monitoring for atypical usage may reveal rogue behavior by individuals or an attack in progress. Account monitoring may inadvertently create privacy risks since data collected to identify atypical usage may reveal previously unknown information about the behavior of individuals. Organizations assess and document privacy risks from monitoring accounts for atypical usage in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(12)

AC-2(12) Account Management | Account Monitoring for Atypical Usage
Family: Access Control (AC) > AC-2 Account Management

(a) Monitor system accounts for [Assignment: organization-defined atypical usage] ; and
(b) Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(13) > Discussion

AC-2(13) Disable Accounts for High-risk Individuals - Discussion
Family: Access Control (AC) > AC-2 Account Management

Users who pose a significant security and/or privacy risk include individuals for whom reliable evidence indicates either the intention to use authorized access to systems to cause harm or through whom adversaries will cause harm. Such harm includes adverse impacts to organizational operations, organizational assets, individuals, other organizations, or the Nation. Close coordination among system administrators, legal staff, human resource managers, and authorizing officials is essential when disabling system accounts for high-risk individuals.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-2 > AC-2(13)

AC-2(13) Account Management | Disable Accounts for High-risk Individuals
Family: Access Control (AC) > AC-2 Account Management

Disable accounts of individuals within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-3

AC-3 Access Enforcement
Family: Access Control (AC)

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.