ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(23) > Assessment Methods

AC-4(23) Modify Non-releasable Information - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(23) > Assessment Objective

AC-4(23) Modify Non-releasable Information - Assessment Objective
Determine if the following are satisfied:

when transferring information between security domains, non-releasable information is modified by implementing [Assignment: organization-defined modification action].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(24) > Assessment Methods

AC-4(24) Internal Normalized Format - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(24) > Assessment Objective

AC-4(24) Internal Normalized Format - Assessment Objective
Determine if the following are satisfied:

AC-04(24)[01] when transferring information between different security domains, incoming data is parsed into an internal, normalized format;
AC-04(24)[02] when transferring information between different security domains, the data is regenerated to be consistent with its intended specification.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(25) > Assessment Methods

AC-4(25) Data Sanitization - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(25) > Assessment Objective

AC-4(25) Data Sanitization - Assessment Objective
Determine if the following are satisfied:

when transferring information between different security domains, data is sanitized to minimize [Selection; one or more: delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data; spillage of sensitive information] in accordance with [Assignment: organization-defined policy].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(26) > Assessment Methods

AC-4(26) Audit Filtering Actions - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions

mechanisms implementing content filtering

mechanisms recording and auditing content filtering
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(26) > Assessment Objective

AC-4(26) Audit Filtering Actions - Assessment Objective
Determine if the following are satisfied:

AC-04(26)[01] when transferring information between different security domains, content-filtering actions are recorded and audited;
AC-04(26)[02] when transferring information between different security domains, results for the information being filtered are recorded and audited.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(27) > Assessment Methods

AC-4(27) Redundant/Independent Filtering Mechanisms - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(27) > Assessment Objective

AC-4(27) Redundant/Independent Filtering Mechanisms - Assessment Objective
Determine if the following are satisfied:

when transferring information between security domains, implemented content filtering solutions provide redundant and independent filtering mechanisms for each data type.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(28) > Assessment Methods

AC-4(28) Linear Filter Pipelines - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions

mechanisms implementing linear content filters
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(28) > Assessment Objective

AC-4(28) Linear Filter Pipelines - Assessment Objective
Determine if the following are satisfied:

when transferring information between security domains, a linear content filter pipeline is implemented that is enforced with discretionary and mandatory access controls.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(29) > Assessment Methods

AC-4(29) Filter Orchestration Engines - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions

mechanisms implementing content filter orchestration engines
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(29) > Assessment Objective

AC-4(29) Filter Orchestration Engines - Assessment Objective
Determine if the following are satisfied:

AC-04(29)(a) when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering mechanisms successfully complete execution without errors;
AC-04(29)(b)[01] when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions occur in the correct order;
AC-04(29)(b)[02] when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions comply with [Assignment: organization-defined policy].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(30) > Assessment Methods

AC-4(30) Filter Mechanisms Using Multiple Processes - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions

mechanisms implementing content filtering
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(30) > Assessment Objective

AC-4(30) Filter Mechanisms Using Multiple Processes - Assessment Objective
Determine if the following are satisfied:

when transferring information between security domains, content-filtering mechanisms using multiple processes are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(31) > Assessment Methods

AC-4(31) Failed Content Transfer Prevention - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(31) > Assessment Objective

AC-4(31) Failed Content Transfer Prevention - Assessment Objective
Determine if the following are satisfied:

when transferring information between different security domains, the transfer of failed content to the receiving domain is prevented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(32) > Assessment Methods

AC-4(32) Process Requirements for Information Transfer - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions

mechanisms implementing content filtering
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(32) > Assessment Objective

AC-4(32) Process Requirements for Information Transfer - Assessment Objective
Determine if the following are satisfied:

AC-04(32)(a) when transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content;
AC-04(32)(b) when transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata;
AC-04(32)(c) when transferring information between different security domains, the process that transfers information between filter pipelines ensures that the content with the filtering metadata has successfully completed filtering;
AC-04(32)(d) when transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-5 > Assessment Methods

AC-5 Separation of Duties - Assessment Methods and Objects

Examine: Access control policy

procedures addressing divisions of responsibility and separation of duties

system configuration settings and associated documentation

list of divisions of responsibility and separation of duties

system access authorizations

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining appropriate divisions of responsibility and separation of duties

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms implementing separation of duties policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-5 > Assessment Objective

AC-5 Separation of Duties - Assessment Objective
Determine if the following are satisfied:

AC-05a. [Assignment: organization-defined duties of individuals] are identified and documented;
AC-05b. system access authorizations to support separation of duties are defined.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > Assessment Methods

AC-6 Least Privilege - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

list of assigned access authorizations (user privileges)

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms implementing least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > Assessment Objective

AC-6 Least Privilege - Assessment Objective
Determine if the following are satisfied:

the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(1) > Assessment Methods

AC-6(1) Authorize Access to Security Functions - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access must be explicitly authorized

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms implementing least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(1) > Assessment Objective

AC-6(1) Authorize Access to Security Functions - Assessment Objective
Determine if the following are satisfied:

AC-06(01)(a)[01] access is authorized for [Assignment: organization-defined individuals and roles] to [Assignment: organization-defined security functions (deployed in hardware)];
AC-06(01)(a)[02] access is authorized for [Assignment: organization-defined individuals and roles] to [Assignment: organization-defined security functions (deployed in software)];
AC-06(01)(a)[03] access is authorized for [Assignment: organization-defined individuals and roles] to [Assignment: organization-defined security functions (deployed in firmware)];
AC-06(01)(b) access is authorized for [Assignment: organization-defined individuals and roles] to [Assignment: organization-defined security-relevant information].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(2) > Assessment Methods

AC-6(2) Non-privileged Access for Nonsecurity Functions - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

list of system-generated security functions or security-relevant information assigned to system accounts or roles

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms implementing least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(2) > Assessment Objective

AC-6(2) Non-privileged Access for Nonsecurity Functions - Assessment Objective
Determine if the following are satisfied:

users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] are required to use non-privileged accounts or roles when accessing non-security functions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(3) > Assessment Methods

AC-6(3) Network Access to Privileged Commands - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

system configuration settings and associated documentation

system audit records

list of operational needs for authorizing network access to privileged commands

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

Test: Mechanisms implementing least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(3) > Assessment Objective

AC-6(3) Network Access to Privileged Commands - Assessment Objective
Determine if the following are satisfied:

AC-06(03)[01] network access to [Assignment: organization-defined privileged commands] is authorized only for [Assignment: organization-defined compelling operational needs];
AC-06(03)[02] the rationale for authorizing network access to privileged commands is documented in the security plan for the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(4) > Assessment Methods

AC-6(4) Separate Processing Domains - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(4) > Assessment Objective

AC-6(4) Separate Processing Domains - Assessment Objective
Determine if the following are satisfied:

separate processing domains are provided to enable finer-grain allocation of user privileges.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(5) > Assessment Methods

AC-6(5) Privileged Accounts - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

list of system-generated privileged accounts

list of system administration personnel

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms implementing least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(5) > Assessment Objective

AC-6(5) Privileged Accounts - Assessment Objective
Determine if the following are satisfied:

privileged accounts on the system are restricted to [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(6) > Assessment Methods

AC-6(6) Privileged Access by Non-organizational Users - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

list of system-generated privileged accounts

list of non-organizational users

system configuration settings and associated documentation

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms prohibiting privileged access to the system
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(6) > Assessment Objective

AC-6(6) Privileged Access by Non-organizational Users - Assessment Objective
Determine if the following are satisfied:

privileged access to the system by non-organizational users is prohibited.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(7) > Assessment Methods

AC-6(7) Review of User Privileges - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

list of system-generated roles or classes of users and assigned privileges

system design documentation

system configuration settings and associated documentation

validation reviews of privileges assigned to roles or classes or users

records of privilege removals or reassignments for roles or classes of users

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms implementing review of user privileges
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(7) > Assessment Objective

AC-6(7) Review of User Privileges - Assessment Objective
Determine if the following are satisfied:

AC-06(07)(a) privileges assigned to [Assignment: organization-defined roles and classes] are reviewed [Assignment: organization-defined frequency] to validate the need for such privileges;
AC-06(07)(b) privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.