ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-4 > PL-4(1) > Assessment Methods

PL-4(1) Social Media and External Site/Application Usage Restrictions - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing rules of behavior for system users

rules of behavior

training policy

other relevant documents or records

Interview: Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior

organizational personnel with responsibility for literacy training and awareness and role-based training

organizational personnel who are authorized users of the system and have signed rules of behavior

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for establishing rules of behavior

mechanisms supporting and/or implementing the establishment of rules of behavior
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-4 > PL-4(1) > Assessment Objective

PL-4(1) Social Media and External Site/Application Usage Restrictions - Assessment Objective
Determine if the following are satisfied:

PL-04(01)(a) the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications;
PL-04(01)(b) the rules of behavior include restrictions on posting organizational information on public websites;
PL-04(01)(c) the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-7 > Assessment Methods

PL-7 Concept of Operations - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing security and privacy CONOPS development

procedures addressing security and privacy CONOPS reviews and updates

security and privacy CONOPS for the system

system security plan

privacy plan

records of security and privacy CONOPS reviews and updates

other relevant documents or records

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for developing, reviewing, and updating the security CONOPS

mechanisms supporting and/or implementing the development, review, and update of the security CONOPS
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-7 > Assessment Objective

PL-7 Concept of Operations - Assessment Objective
Determine if the following are satisfied:

PL-07a. a CONOPS for the system describing how the organization intends to operate the system from the perspective of information security and privacy is developed;
PL-07b. the CONOPS is reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-8 > Assessment Methods

PL-8 Security and Privacy Architectures - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing information security and privacy architecture development

procedures addressing information security and privacy architecture reviews and updates

enterprise architecture documentation

information security and privacy architecture documentation

system security plan

privacy plan

security and privacy CONOPS for the system

records of information security and privacy architecture reviews and updates

other relevant documents or records

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities

organizational personnel with information security and privacy architecture development responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for developing, reviewing, and updating the information security and privacy architecture

mechanisms supporting and/or implementing the development, review, and update of the information security and privacy architecture
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-8 > Assessment Objective

PL-8 Security and Privacy Architectures - Assessment Objective
Determine if the following are satisfied:

PL-08a.01 a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
PL-08a.02 a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
PL-08a.03[01] a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;
PL-08a.03[02] a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;
PL-08a.04[01] a security architecture for the system describes any assumptions about and dependencies on external systems and services;
PL-08a.04[02] a privacy architecture for the system describes any assumptions about and dependencies on external systems and services;
PL-08b. changes in the enterprise architecture are reviewed and updated [Assignment: organization-defined frequency] to reflect changes in the enterprise architecture;
PL-08c.[01] planned architecture changes are reflected in the security plan;
PL-08c.[02] planned architecture changes are reflected in the privacy plan;
PL-08c.[03] planned architecture changes are reflected in the Concept of Operations (CONOPS);
PL-08c.[04] planned architecture changes are reflected in criticality analysis;
PL-08c.[05] planned architecture changes are reflected in organizational procedures;
PL-08c.[06] planned architecture changes are reflected in procurements and acquisitions.
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-8 > PL-8(1) > Assessment Methods

PL-8(1) Defense in Depth - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing information security and privacy architecture development

enterprise architecture documentation

information security and privacy architecture documentation

system security plan

privacy plan

security and privacy CONOPS for the system

other relevant documents or records

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities

organizational personnel with information security and privacy architecture development responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for designing the information security and privacy architecture

mechanisms supporting and/or implementing the design of the information security and privacy architecture
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-8 > PL-8(1) > Assessment Objective

PL-8(1) Defense in Depth - Assessment Objective
Determine if the following are satisfied:

PL-08(01)(a)[01] the security architecture for the system is designed using a defense-in-depth approach that allocates [Assignment: organization-defined controls] to [Assignment: organization-defined locations and architectural layers];
PL-08(01)(a)[02] the privacy architecture for the system is designed using a defense-in-depth approach that allocates [Assignment: organization-defined controls] to [Assignment: organization-defined locations and architectural layers];
PL-08(01)(b)[01] the security architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner;
PL-08(01)(b)[02] the privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-8 > PL-8(2) > Assessment Methods

PL-8(2) Supplier Diversity - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing information security and privacy architecture development

enterprise architecture documentation

information security and privacy architecture documentation

system security plan

privacy plan

security and privacy CONOPS for the system

IT acquisitions policy

other relevant documents or records

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities

organizational personnel with information security and privacy architecture development responsibilities

organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for obtaining information security and privacy safeguards from different suppliers
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-8 > PL-8(2) > Assessment Objective

PL-8(2) Supplier Diversity - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls] that are allocated to [Assignment: organization-defined locations and architectural layers] are required to be obtained from different suppliers.
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-9 > Assessment Methods

PL-9 Central Management - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing security and privacy plan development and implementation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities

organizational personnel with responsibilities for planning/implementing central management of controls and related processes

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for the central management of controls and related processes

mechanisms supporting and/or implementing central management of controls and related processes
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-9 > Assessment Objective

PL-9 Central Management - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls and related processes] are centrally managed.
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-10 > Assessment Methods

PL-10 Baseline Selection - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing system security and privacy plan development and implementation

procedures addressing system security and privacy plan reviews and updates

system design documentation

system architecture and configuration documentation

system categorization decision

information types stored, transmitted, and processed by the system

system element/component information

stakeholder needs analysis

list of security and privacy requirements allocated to the system, system elements, and environment of operation

list of contractual requirements allocated to external providers of the system or system element

business impact analysis or criticality analysis

risk assessments

risk management strategy

organizational security and privacy policy

federal or organization-approved or mandated baselines or overlays

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with responsibility for organizational risk management activities
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-10 > Assessment Objective

PL-10 Baseline Selection - Assessment Objective
Determine if the following are satisfied:

a control baseline for the system is selected.
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-11 > Assessment Methods

PL-11 Baseline Tailoring - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing system security and privacy plan development and implementation

system design documentation

system categorization decision

information types stored, transmitted, and processed by the system

system element/component information

stakeholder needs analysis

list of security and privacy requirements allocated to the system, system elements, and environment of operation

list of contractual requirements allocated to external providers of the system or system element

business impact analysis or criticality analysis

risk assessments

risk management strategy

organizational security and privacy policy

federal or organization-approved or mandated baselines or overlays

baseline tailoring rationale

system security plan

privacy plan

records of system security and privacy plan reviews and updates

other relevant documents or records

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-11 > Assessment Objective

PL-11 Baseline Tailoring - Assessment Objective
Determine if the following are satisfied:

the selected control baseline is tailored by applying specified tailoring actions.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-1 > Assessment Methods

PM-1 Information Security Program Plan - Assessment Methods and Objects

Examine: Information security program plan

procedures addressing program plan development and implementation

procedures addressing program plan reviews and updates

procedures addressing coordination of the program plan with relevant entities

procedures for program plan approvals

records of program plan reviews and updates

other relevant documents or records

Interview: Organizational personnel with information security program planning and plan implementation responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for information security program plan development, review, update, and approval

mechanisms supporting and/or implementing the information security program plan
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-1 > Assessment Objective

PM-1 Information Security Program Plan - Assessment Objective
Determine if the following are satisfied:

PM-01a.[01] an organization-wide information security program plan is developed;
PM-01a.[02] the information security program plan is disseminated;
PM-01a.01[01] the information security program plan provides an overview of the requirements for the security program;
PM-01a.01[02] the information security program plan provides a description of the security program management controls in place or planned for meeting those requirements;
PM-01a.01[03] the information security program plan provides a description of the common controls in place or planned for meeting those requirements;
PM-01a.02[01] the information security program plan includes the identification and assignment of roles;
PM-01a.02[02] the information security program plan includes the identification and assignment of responsibilities;
PM-01a.02[03] the information security program plan addresses management commitment;
PM-01a.02[04] the information security program plan addresses coordination among organizational entities;
PM-01a.02[05] the information security program plan addresses compliance;
PM-01a.03 the information security program plan reflects the coordination among the organizational entities responsible for information security;
PM-01a.04 the information security program plan is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
PM-01b.[01] the information security program plan is reviewed and updated [Assignment: organization-defined frequency];
PM-01b.[02] the information security program plan is reviewed and updated following [Assignment: organization-defined events];
PM-01c.[01] the information security program plan is protected from unauthorized disclosure;
PM-01c.[02] the information security program plan is protected from unauthorized modification.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-2 > Assessment Methods

PM-2 Information Security Program Leadership Role - Assessment Methods and Objects

Examine: Information security program plan

procedures addressing program plan development and implementation

procedures addressing program plan reviews and updates

procedures addressing coordination of the program plan with relevant entities

other relevant documents or records

Interview: Organizational personnel with information security program planning and plan implementation responsibilities

senior information security officer

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-2 > Assessment Objective

PM-2 Information Security Program Leadership Role - Assessment Objective
Determine if the following are satisfied:

PM-02[01] a senior agency information security officer is appointed;
PM-02[02] the senior agency information security officer is provided with the mission and resources to coordinate an organization-wide information security program;
PM-02[03] the senior agency information security officer is provided with the mission and resources to develop an organization-wide information security program;
PM-02[04] the senior agency information security officer is provided with the mission and resources to implement an organization-wide information security program;
PM-02[05] the senior agency information security officer is provided with the mission and resources to maintain an organization-wide information security program.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-3 > Assessment Methods

PM-3 Information Security and Privacy Resources - Assessment Methods and Objects

Examine: Information security program plan

Exhibit 300

Exhibit 53

business cases for capital planning and investment

procedures for capital planning and investment

documentation of exceptions to capital planning requirements

other relevant documents or records

Interview: Organizational personnel with information security program planning responsibilities

organizational personnel with privacy program planning responsibilities

organizational personnel responsible for capital planning and investment

organizational personnel with information security responsibilities

organizational personnel with privacy responsibilities

Test: Organizational processes for capital planning and investment

organizational processes for business case, Exhibit 300, and Exhibit 53 development

mechanisms supporting the capital planning and investment process
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-3 > Assessment Objective

PM-3 Information Security and Privacy Resources - Assessment Objective
Determine if the following are satisfied:

PM-03a.[01] the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented;
PM-03a.[02] the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented;
PM-03b.[01] the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
PM-03b.[02] the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
PM-03c.[01] information security resources are made available for expenditure as planned;
PM-03c.[02] privacy resources are made available for expenditure as planned.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-4 > Assessment Methods

PM-4 Plan of Action and Milestones Process - Assessment Methods and Objects

Examine: Information security program plan

plans of action and milestones

procedures addressing plans of action and milestones development and maintenance

procedures addressing plans of action and milestones reporting

procedures for reviewing plans of action and milestones for consistency with risk management strategy and risk response priorities

results of risk assessments associated with plans of action and milestones

OMB FISMA reporting requirements

other relevant documents or records

Interview: Organizational personnel with responsibilities for developing, maintaining, reviewing, and reporting plans of action and milestones

organizational personnel with information security responsibilities

Test: Organizational processes for plan of action and milestones development, review, maintenance, and reporting

mechanisms supporting plans of action and milestones