ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-2 > Assessment Methods

SR-2 Supply Chain Risk Management Plan - Assessment Methods and Objects

Examine: Supply chain risk management policy

supply chain risk management procedures

supply chain risk management plan

system and services acquisition policy

system and services acquisition procedures

procedures addressing supply chain protection

procedures for protecting the supply chain risk management plan from unauthorized disclosure and modification

system development life cycle procedures

procedures addressing the integration of information security and privacy requirements into the acquisition process

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

list of supply chain threats

list of safeguards to be taken against supply chain threats

system life cycle documentation

inter-organizational agreements and procedures

system security plan

privacy plan

privacy program plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and documenting the system development life cycle (SDLC)

organizational processes for identifying SDLC roles and responsibilities

organizational processes for integrating supply chain risk management into the SDLC

mechanisms supporting and/or implementing the SDLC
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-2 > Assessment Objective

SR-2 Supply Chain Risk Management Plan - Assessment Objective
Determine if the following are satisfied:

SR-02a.[01] a plan for managing supply chain risks is developed;
SR-02a.[02] the supply chain risk management plan addresses risks associated with the research and development of [Assignment: organization-defined systems, system components, or system services];
SR-02a.[03] the supply chain risk management plan addresses risks associated with the design of [Assignment: organization-defined systems, system components, or system services];
SR-02a.[04] the supply chain risk management plan addresses risks associated with the manufacturing of [Assignment: organization-defined systems, system components, or system services];
SR-02a.[05] the supply chain risk management plan addresses risks associated with the acquisition of [Assignment: organization-defined systems, system components, or system services];
SR-02a.[06] the supply chain risk management plan addresses risks associated with the delivery of [Assignment: organization-defined systems, system components, or system services];
SR-02a.[07] the supply chain risk management plan addresses risks associated with the integration of [Assignment: organization-defined systems, system components, or system services];
SR-02a.[08] the supply chain risk management plan addresses risks associated with the operation and maintenance of [Assignment: organization-defined systems, system components, or system services];
SR-02a.[09] the supply chain risk management plan addresses risks associated with the disposal of [Assignment: organization-defined systems, system components, or system services];
SR-02b. the supply chain risk management plan is reviewed and updated [Assignment: organization-defined frequency] or as required to address threat, organizational, or environmental changes;
SR-02c.[01] the supply chain risk management plan is protected from unauthorized disclosure;
SR-02c.[02] the supply chain risk management plan is protected from unauthorized modification.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-2 > SR-2(1) > Assessment Methods

SR-2(1) Establish SCRM Team - Assessment Methods and Objects

Examine: Supply chain risk management policy

supply chain risk management procedures

supply chain risk management team charter documentation

supply chain risk management strategy

supply chain risk management implementation plan

procedures addressing supply chain protection

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

organizational personnel with enterprise risk management responsibilities

legal counsel

organizational personnel with business continuity responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-2 > SR-2(1) > Assessment Objective

SR-2(1) Establish SCRM Team - Assessment Objective
Determine if the following are satisfied:

a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles and responsibilities] is established to lead and support [Assignment: organization-defined supply chain risk management activities].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > Assessment Methods

SR-3 Supply Chain Controls and Processes - Assessment Methods and Objects

Examine: Supply chain risk management policy

supply chain risk management procedures

supply chain risk management strategy

supply chain risk management plan

systems and critical system components inventory documentation

system and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of information security and privacy requirements into the acquisition process

solicitation documentation

acquisition documentation (including purchase orders)

service level agreements

acquisition contracts for systems or services

risk register documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for identifying and addressing supply chain element and process deficiencies
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > Assessment Objective

SR-3 Supply Chain Controls and Processes - Assessment Objective
Determine if the following are satisfied:

SR-03a.[01] a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component];
SR-03a.[02] the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component] is/are coordinated with [Assignment: organization-defined supply chain personnel];
SR-03b. [Assignment: organization-defined supply chain controls] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events;
SR-03c. the selected and implemented supply chain processes and controls are documented in [Selection; one or more: security and privacy plans; supply chain risk management plan; [Assignment: organization-defined document] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > SR-3(1) > Assessment Methods

SR-3(1) Diverse Supply Base - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

system and services acquisition policy

planning policy

procedures addressing supply chain protection

physical inventory of critical systems and system components

inventory of critical suppliers, service providers, developers, and contracts

inventory records of critical system components

list of security safeguards ensuring an adequate supply of critical system components

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain protection responsibilities

Test: Organizational processes for defining and employing security safeguards to ensure an adequate supply of critical system components

processes to identify critical suppliers

mechanisms supporting and/or implementing the security safeguards that ensure an adequate supply of critical system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > SR-3(1) > Assessment Objective

SR-3(1) Diverse Supply Base - Assessment Objective
Determine if the following are satisfied:

SR-03(01)[01] a diverse set of sources is employed for [Assignment: organization-defined system components];
SR-03(01)[02] a diverse set of sources is employed for [Assignment: organization-defined services].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > SR-3(2) > Assessment Methods

SR-3(2) Limitation of Harm - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

configuration management policy

procedures addressing supply chain protection

procedures addressing the integration of information security requirements into the acquisition process

procedures addressing the baseline configuration of the system

configuration management plan

system design documentation

system architecture and associated configuration documentation

solicitation documentation

acquisition documentation

acquisition contracts for the system, system component, or system service

threat assessments

vulnerability assessments

list of security safeguards to be taken to protect the organizational supply chain against potential supply chain threats

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and employing safeguards to limit harm from adversaries of the organizational supply chain

mechanisms supporting and/or implementing the definition and employment of safeguards to protect the organizational supply chain
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > SR-3(2) > Assessment Objective

SR-3(2) Limitation of Harm - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls] are employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > SR-3(3) > Assessment Methods

SR-3(3) Sub-tier Flow Down - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

inter-organizational agreements and procedures

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-3 > SR-3(3) > Assessment Objective

SR-3(3) Sub-tier Flow Down - Assessment Objective
Determine if the following are satisfied:

the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > Assessment Methods

SR-4 Provenance - Assessment Methods and Objects

Examine: Supply chain risk management policy

supply chain risk management procedures

supply chain risk management plan

documentation of critical systems, critical system components, and associated data

documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components

system architecture

inter-organizational agreements and procedures

contracts

system security plan

privacy plan

personally identifiable information processing policy

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for identifying the provenance of critical systems and critical system components

mechanisms used to document, monitor, or maintain provenance
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > Assessment Objective

SR-4 Provenance - Assessment Objective
Determine if the following are satisfied:

SR-04[01] valid provenance is documented for [Assignment: organization-defined systems, system components, and associated data];
SR-04[02] valid provenance is monitored for [Assignment: organization-defined systems, system components, and associated data];
SR-04[03] valid provenance is maintained for [Assignment: organization-defined systems, system components, and associated data].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(1) > Assessment Methods

SR-4(1) Identity - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

procedures addressing the integration of information security requirements into the acquisition process

list of supply chain elements, processes, and actors (associated with the system, system component, or system service) requiring implementation of unique identification processes, procedures, tools, mechanisms, equipment, techniques, and/or configurations

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain protection responsibilities

organizational personnel with responsibilities for establishing and retaining the unique identification of supply chain elements, processes, and actors

Test: Organizational processes for defining, establishing, and retaining unique identification for supply chain elements, processes, and actors

mechanisms supporting and/or implementing the definition, establishment, and retention of unique identification for supply chain elements, processes, and actors
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(1) > Assessment Objective

SR-4(1) Identity - Assessment Objective
Determine if the following are satisfied:

SR-04(01)[01] unique identification of [Assignment: organization-defined supply chain elements, processes, and personnel] is established;
SR-04(01)[02] unique identification of [Assignment: organization-defined supply chain elements, processes, and personnel] is maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(2) > Assessment Methods

SR-4(2) Track and Trace - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

system and services acquisition policy

procedures addressing supply chain protection

procedures addressing the integration of information security requirements into the acquisition process

supply chain risk management plan

list of supply chain elements, processes, and actors (associated with the system, system component, or system service) requiring implementation of unique identification processes, procedures, tools, mechanisms, equipment, techniques, and/or configurations

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain protection responsibilities

organizational personnel with responsibilities for establishing and retaining the unique identification of supply chain elements, processes, and actors

Test: Organizational processes for defining, establishing, and retaining unique identification for supply chain elements, processes, and actors

mechanisms supporting and/or implementing the definition, establishment, and retention of unique identification for supply chain elements, processes, and actors
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(2) > Assessment Objective

SR-4(2) Track and Trace - Assessment Objective
Determine if the following are satisfied:

SR-04(02)[01] the unique identification of [Assignment: organization-defined systems and critical system components] is established for tracking through the supply chain;
SR-04(02)[02] the unique identification of [Assignment: organization-defined systems and critical system components] is maintained for tracking through the supply chain.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(3) > Assessment Methods

SR-4(3) Validate as Genuine and Not Altered - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

procedures addressing the security design principle of trusted components used in the specification, design, development, implementation, and modification of the system

system design documentation

procedures addressing the integration of information security requirements into the acquisition process

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

evidentiary documentation (including applicable configurations) indicating that the system or system component is genuine and has not been altered

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and employing validation safeguards

mechanisms supporting and/or implementing the definition and employment of validation safeguards

mechanisms supporting the application of the security design principle of trusted components in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(3) > Assessment Objective

SR-4(3) Validate as Genuine and Not Altered - Assessment Objective
Determine if the following are satisfied:

SR-04(03)[01] [Assignment: organization-defined controls] are employed to validate that the system or system component received is genuine;
SR-04(03)[02] [Assignment: organization-defined controls] are employed to validate that the system or system component received has not been altered.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(4) > Assessment Methods

SR-4(4) Supply Chain Integrity - Pedigree - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

bill of materials for critical systems or system components

acquisition documentation

software identification tags

manufacturer declarations of platform attributes (e.g., serial numbers, hardware component inventory) and measurements (e.g., firmware hashes) that are tightly bound to the hardware itself

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for identifying pedigree information

organizational processes to determine and validate the integrity of the internal composition of critical systems and critical system components

mechanisms to determine and validate the integrity of the internal composition of critical systems and critical system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-4 > SR-4(4) > Assessment Objective

SR-4(4) Supply Chain Integrity - Pedigree - Assessment Objective
Determine if the following are satisfied:

SR-04(04)[01] [Assignment: organization-defined controls] are employed to ensure the integrity of the system and system components;
SR-04(04)[02] [Assignment: organization-defined analysis method] is conducted to ensure the integrity of the system and system components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-5 > Assessment Methods

SR-5 Acquisition Strategies, Tools, and Methods - Assessment Methods and Objects

Examine: Supply chain risk management policy

supply chain risk management procedures

supply chain risk management plan

system and services acquisition policy

system and services acquisition procedures

procedures addressing supply chain protection

procedures addressing the integration of information security and privacy requirements into the acquisition process

solicitation documentation

acquisition documentation (including purchase orders)

service level agreements

acquisition contracts for systems, system components, or services

documentation of training, education, and awareness programs for personnel regarding supply chain risk

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods

mechanisms supporting and/or implementing the definition and employment of tailored acquisition strategies, contract tools, and procurement methods
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-5 > Assessment Objective

SR-5 Acquisition Strategies, Tools, and Methods - Assessment Objective
Determine if the following are satisfied:

SR-05[01] [Assignment: organization-defined strategies, tools, and methods] are employed to protect against supply chain risks;
SR-05[02] [Assignment: organization-defined strategies, tools, and methods] are employed to identify supply chain risks;
SR-05[03] [Assignment: organization-defined strategies, tools, and methods] are employed to mitigate supply chain risks.