ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-14 > PE-14(1) > Assessment Methods

PE-14(1) Automatic Controls - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing temperature and humidity controls

facility housing the system

automated mechanisms for temperature and humidity

temperature and humidity controls

temperature and humidity documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for system environmental controls

organizational personnel with information security responsibilities

Test: Automated mechanisms supporting and/or implementing temperature and humidity levels
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-14 > PE-14(1) > Assessment Objective

PE-14(1) Automatic Controls - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined automatic environmental controls] are employed in the facility to prevent fluctuations that are potentially harmful to the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-14 > PE-14(2) > Assessment Methods

PE-14(2) Monitoring with Alarms and Notifications - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing temperature and humidity monitoring

facility housing the system

logs or records of temperature and humidity monitoring

records of changes to temperature and humidity levels that generate alarms or notifications

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for system environmental controls

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing temperature and humidity monitoring
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-14 > PE-14(2) > Assessment Objective

PE-14(2) Monitoring with Alarms and Notifications - Assessment Objective
Determine if the following are satisfied:

PE-14(02)[01] environmental control monitoring is employed;
PE-14(02)[02] the environmental control monitoring capability provides an alarm or notification to [Assignment: organization-defined personnel or roles] when changes are potentially harmful to personnel or equipment.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-15 > Assessment Methods

PE-15 Water Damage Protection - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing water damage protection

facility housing the system

master shutoff valves

list of key personnel with knowledge of location and activation procedures for master shutoff valves for the plumbing system

master shutoff valve documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for system environmental controls

organizational personnel with information security responsibilities

Test: Master water-shutoff valves

organizational process for activating master water shutoff
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-15 > Assessment Objective

PE-15 Water Damage Protection - Assessment Objective
Determine if the following are satisfied:

PE-15[01] the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves;
PE-15[02] the master shutoff or isolation valves are accessible;
PE-15[03] the master shutoff or isolation valves are working properly;
PE-15[04] the master shutoff or isolation valves are known to key personnel.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-15 > PE-15(1) > Assessment Methods

PE-15(1) Automation Support - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing water damage protection

facility housing the system

automated mechanisms for water shutoff valves

automated mechanisms for detecting the presence of water in the vicinity of the system

alerts/notifications of water detection in system facility

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for system environmental controls

organizational personnel with information security responsibilities

Test: Automated mechanisms supporting and/or implementing water detection capabilities and alerts for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-15 > PE-15(1) > Assessment Objective

PE-15(1) Automation Support - Assessment Objective
Determine if the following are satisfied:

PE-15(01)[01] the presence of water near the system can be detected automatically;
PE-15(01)[02] [Assignment: organization-defined personnel or roles] is/are alerted using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-16 > Assessment Methods

PE-16 Delivery and Removal - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing the delivery and removal of system components from the facility

facility housing the system

records of items entering and exiting the facility

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for controlling system components entering and exiting the facility

organizational personnel with information security responsibilities

Test: Organizational process for authorizing, monitoring, and controlling system-related items entering and exiting the facility

mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system-related items entering and exiting the facility
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-16 > Assessment Objective

PE-16 Delivery and Removal - Assessment Objective
Determine if the following are satisfied:

PE-16a.[01] [Assignment: organization-defined types of system components] are authorized when entering the facility;
PE-16a.[02] [Assignment: organization-defined types of system components] are controlled when entering the facility;
PE-16a.[03] [Assignment: organization-defined types of system components] are authorized when exiting the facility;
PE-16a.[04] [Assignment: organization-defined types of system components] are controlled when exiting the facility;
PE-16b. records of the system components are maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-17 > Assessment Methods

PE-17 Alternate Work Site - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing alternate work sites for organizational personnel

list of security controls required for alternate work sites

assessments of security controls at alternate work sites

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel approving the use of alternate work sites

organizational personnel using alternate work sites

organizational personnel assessing controls at alternate work sites

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for security and privacy at alternate work sites

mechanisms supporting alternate work sites

security and privacy controls employed at alternate work sites

means of communication between personnel at alternate work sites and security and privacy personnel
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-17 > Assessment Objective

PE-17 Alternate Work Site - Assessment Objective
Determine if the following are satisfied:

PE-17a. [Assignment: organization-defined alternate work sites] are determined and documented;
PE-17b. [Assignment: organization-defined controls] are employed at alternate work sites;
PE-17c. the effectiveness of controls at alternate work sites is assessed;
PE-17d. a means for employees to communicate with information security and privacy personnel in case of incidents is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-18 > Assessment Methods

PE-18 Location of System Components - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing the positioning of system components

documentation providing the location and position of system components within the facility

locations housing system components within the facility

list of physical and environmental hazards with the potential to damage system components within the facility

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for positioning system components

organizational personnel with information security responsibilities

Test: Organizational processes for positioning system components
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-18 > Assessment Objective

PE-18 Location of System Components - Assessment Objective
Determine if the following are satisfied:

system components are positioned within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-19 > Assessment Methods

PE-19 Information Leakage - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing information leakage due to electromagnetic signal emanations

mechanisms protecting the system against electronic signal emanations

facility housing the system

records from electromagnetic signal emanation tests

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for system environmental controls

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing protection from information leakage due to electromagnetic signal emanations
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-19 > Assessment Objective

PE-19 Information Leakage - Assessment Objective
Determine if the following are satisfied:

the system is protected from information leakage due to electromagnetic signal emanations.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-19 > PE-19(1) > Assessment Methods

PE-19(1) National Emissions Policies and Procedures - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing information leakage that comply with national emissions and TEMPEST policies and procedures

system component design documentation

system configuration settings and associated documentation system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for system environmental controls

organizational personnel with information security responsibilities

Test: Information system components for compliance with national emissions and TEMPEST policies and procedures
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-19 > PE-19(1) > Assessment Objective

PE-19(1) National Emissions Policies and Procedures - Assessment Objective
Determine if the following are satisfied:

PE-19(01)[01] system components are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information;
PE-19(01)[02] associated data communications are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information;
PE-19(01)[03] networks are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-20 > Assessment Methods

PE-20 Asset Monitoring and Tracking - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing asset monitoring and tracking

documentation showing the use of asset location technologies

system configuration documentation

list of organizational assets requiring tracking and monitoring

asset monitoring and tracking records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with asset monitoring and tracking responsibilities

legal counsel

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for tracking and monitoring assets

mechanisms supporting and/or implementing the tracking and monitoring of assets
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-20 > Assessment Objective

PE-20 Asset Monitoring and Tracking - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined asset location technologies] are employed to track and monitor the location and movement of [Assignment: organization-defined assets] within [Assignment: organization-defined controlled areas].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-21 > Assessment Methods

PE-21 Electromagnetic Pulse Protection - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing protective measures to mitigate EMP risk to systems and components

documentation detailing protective measures to mitigate EMP risk

list of locations where protective measures to mitigate EMP risk are implemented

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for physical and environmental protection

system developers/integrators

organizational personnel with information security responsibilities

Test: Mechanisms for mitigating EMP risk
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-21 > Assessment Objective

PE-21 Electromagnetic Pulse Protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined protective measures] are employed against electromagnetic pulse damage for [Assignment: organization-defined system and system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-22 > Assessment Methods

PE-22 Component Marking - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing component marking

list of component marking security attributes

component inventory

information types and their impact/classification level

system security plan

other relevant documents or records

Interview: Organizational personnel with component marking responsibilities

organizational personnel with component inventory responsibilities

organizational personnel with information categorization/classification responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for component marking

automated mechanisms supporting and/or implementing component marking
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-22 > Assessment Objective

PE-22 Component Marking - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined system hardware components] are marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-23 > Assessment Methods

PE-23 Facility Location - Assessment Methods and Objects

Examine: Physical and environmental protection policy

physical site planning documents

organizational assessment of risk

contingency plan

risk mitigation strategy documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with site selection responsibilities for the facility housing the system

organizational personnel with risk mitigation responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for site planning
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-23 > Assessment Objective

PE-23 Facility Location - Assessment Objective
Determine if the following are satisfied:

PE-23a. the location or site of the facility where the system resides is planned considering physical and environmental hazards;
PE-23b. for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-1 > Assessment Methods

PL-1 Policy and Procedures - Assessment Methods and Objects

Examine: Planning policy and procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with planning responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-1 > Assessment Objective

PL-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

PL-01a.[01] a planning policy is developed and documented.
PL-01a.[02] the planning policy is disseminated to [Assignment: organization-defined personnel or roles];
PL-01a.[03] planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented;
PL-01a.[04] the planning procedures are disseminated to [Assignment: organization-defined personnel or roles];
PL-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy addresses purpose;
PL-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy addresses scope;
PL-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy addresses roles;
PL-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy addresses responsibilities;
PL-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy addresses management commitment;
PL-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy addresses coordination among organizational entities;
PL-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy addresses compliance;
PL-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
PL-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the planning policy and procedures;
PL-01c.01[01] the current planning policy is reviewed and updated [Assignment: organization-defined frequency];
PL-01c.01[02] the current planning policy is reviewed and updated following [Assignment: organization-defined events];
PL-01c.02[01] the current planning procedures are reviewed and updated [Assignment: organization-defined frequency];
PL-01c.02[02] the current planning procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-2 > Assessment Methods

PL-2 System Security and Privacy Plans - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing system security and privacy plan development and implementation

procedures addressing security and privacy plan reviews and updates

enterprise architecture documentation

system security plan

privacy plan

records of system security and privacy plan reviews and updates

security and privacy architecture and design documentation

risk assessments

risk assessment results

control assessment documentation

other relevant documents or records

Interview: Organizational personnel with system security and privacy planning and plan implementation responsibilities

system developers

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for system security and privacy plan development, review, update, and approval

mechanisms supporting the system security and privacy plan
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-4 > Assessment Methods

PL-4 Rules of Behavior - Assessment Methods and Objects

Examine: Security and privacy planning policy

procedures addressing rules of behavior for system users

rules of behavior

signed acknowledgements

records for rules of behavior reviews and updates

other relevant documents or records

Interview: Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior

organizational personnel with responsibility for literacy training and awareness and role-based training

organizational personnel who are authorized users of the system and have signed and resigned rules of behavior

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for establishing, reviewing, disseminating, and updating rules of behavior

mechanisms supporting and/or implementing the establishment, review, dissemination, and update of rules of behavior
Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-4 > Assessment Objective

PL-4 Rules of Behavior - Assessment Objective
Determine if the following are satisfied:

PL-04a.[01] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system;
PL-04a.[02] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system;
PL-04b. before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received;
PL-04c. rules of behavior are reviewed and updated [Assignment: organization-defined frequency];
PL-04d. individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [Selection; one or more: [Assignment: organization-defined frequency] ; when the rules are revised or updated].