ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(16) > Assessment Objective

SI-7(16) Time Limit on Process Execution Without Supervision - Assessment Objective
Determine if the following are satisfied:

processes are prohibited from executing without supervision for more than [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(17) > Assessment Methods

SI-7(17) Runtime Application Self-protection - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software and information integrity

system design documentation

system configuration settings and associated documentation

list of known vulnerabilities addressed by runtime instrumentation

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Software, firmware, and information integrity verification tools

mechanisms supporting and/or implementing runtime application self-protection
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(17) > Assessment Objective

SI-7(17) Runtime Application Self-protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls] are implemented for application self-protection at runtime.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-8 > Assessment Methods

SI-8 Spam Protection - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

configuration management policies and procedures (CM-01)

procedures addressing spam protection

spam protection mechanisms

records of spam protection updates

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for spam protection

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for implementing spam protection

mechanisms supporting and/or implementing spam protection
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-8 > Assessment Objective

SI-8 Spam Protection - Assessment Objective
Determine if the following are satisfied:

SI-08a.[01] spam protection mechanisms are employed at system entry points to detect unsolicited messages;
SI-08a.[02] spam protection mechanisms are employed at system exit points to detect unsolicited messages;
SI-08a.[03] spam protection mechanisms are employed at system entry points to act on unsolicited messages;
SI-08a.[04] spam protection mechanisms are employed at system exit points to act on unsolicited messages;
SI-08b. spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-8 > SI-8(2) > Assessment Methods

SI-8(2) Automatic Updates - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing spam protection

spam protection mechanisms

records of spam protection updates

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for spam protection

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for spam protection

mechanisms supporting and/or implementing automatic updates to spam protection mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-8 > SI-8(2) > Assessment Objective

SI-8(2) Automatic Updates - Assessment Objective
Determine if the following are satisfied:

spam protection mechanisms are automatically updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-8 > SI-8(3) > Assessment Methods

SI-8(3) Continuous Learning Capability - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing spam protection

spam protection mechanisms

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for spam protection

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for spam protection

mechanisms supporting and/or implementing spam protection mechanisms with a learning capability
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-8 > SI-8(3) > Assessment Objective

SI-8(3) Continuous Learning Capability - Assessment Objective
Determine if the following are satisfied:

spam protection mechanisms with a learning capability are implemented to more effectively identify legitimate communications traffic.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > Assessment Methods

SI-10 Information Input Validation - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

access control policy and procedures

separation of duties policy and procedures

procedures addressing information input validation

documentation for automated tools and applications to verify the validity of information

list of information inputs requiring validity checks

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Mechanisms supporting and/or implementing validity checks on information inputs
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > Assessment Objective

SI-10 Information Input Validation - Assessment Objective
Determine if the following are satisfied:

the validity of the [Assignment: organization-defined information inputs] is checked.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(1) > Assessment Methods

SI-10(1) Manual Override Capability - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

access control policy and procedures

separation of duties policy and procedures

procedures addressing information input validation

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for the use of a manual override capability

mechanisms supporting and/or implementing a manual override capability for input validation

mechanisms supporting and/or implementing auditing of the use of a manual override capability
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(1) > Assessment Objective

SI-10(1) Manual Override Capability - Assessment Objective
Determine if the following are satisfied:

SI-10(01)(a) a manual override capability for the validation of [Assignment: organization-defined information inputs] is provided;
SI-10(01)(b) the use of the manual override capability is restricted to only [Assignment: organization-defined authorized individuals];
SI-10(01)(c) the use of the manual override capability is audited.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(2) > Assessment Methods

SI-10(2) Review and Resolve Errors - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing information input validation

system design documentation

system configuration settings and associated documentation

review records of information input validation errors and resulting resolutions

information input validation error logs or records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for the review and resolution of input validation errors

mechanisms supporting and/or implementing the review and resolution of input validation errors
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(2) > Assessment Objective

SI-10(2) Review and Resolve Errors - Assessment Objective
Determine if the following are satisfied:

SI-10(02)[01] input validation errors are reviewed within [Assignment: organization-defined time period];
SI-10(02)[02] input validation errors are resolved within [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(3) > Assessment Methods

SI-10(3) Predictable Behavior - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing information input validation

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Automated mechanisms supporting and/or implementing predictable behavior when invalid inputs are received
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(3) > Assessment Objective

SI-10(3) Predictable Behavior - Assessment Objective
Determine if the following are satisfied:

SI-10(03)[01] the system behaves in a predictable manner when invalid inputs are received;
SI-10(03)[02] the system behaves in a documented manner when invalid inputs are received.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(4) > Assessment Methods

SI-10(4) Timing Interactions - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing information input validation

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for determining appropriate responses to invalid inputs

automated mechanisms supporting and/or implementing responses to invalid inputs
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(4) > Assessment Objective

SI-10(4) Timing Interactions - Assessment Objective
Determine if the following are satisfied:

timing interactions among system components are accounted for in determining appropriate responses for invalid inputs.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(5) > Assessment Methods

SI-10(5) Restrict Inputs to Trusted Sources and Approved Formats - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing information input validation

system design documentation

system configuration settings and associated documentation

list of trusted sources for information inputs

list of acceptable formats for input restrictions

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for restricting information inputs

automated mechanisms supporting and/or implementing restriction of information inputs
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(5) > Assessment Objective

SI-10(5) Restrict Inputs to Trusted Sources and Approved Formats - Assessment Objective
Determine if the following are satisfied:

the use of information inputs is restricted to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(6) > Assessment Methods

SI-10(6) Injection Prevention - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing information input validation

system design documentation

system configuration settings and associated documentation

list of trusted sources for information inputs

list of acceptable formats for input restrictions

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for preventing untrusted data injections

automated mechanisms supporting and/or implementing injection prevention
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-10 > SI-10(6) > Assessment Objective

SI-10(6) Injection Prevention - Assessment Objective
Determine if the following are satisfied:

untrusted data injections are prevented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-11 > Assessment Methods

SI-11 Error Handling - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing system error handling

system design documentation

system configuration settings and associated documentation

documentation providing the structure and content of error messages

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for information input validation

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for error handling

automated mechanisms supporting and/or implementing error handling

automated mechanisms supporting and/or implementing the management of error messages
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-11 > Assessment Objective

SI-11 Error Handling - Assessment Objective
Determine if the following are satisfied:

SI-11a. error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited;
SI-11b. error messages are revealed only to [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > Assessment Methods

SI-12 Information Management and Retention - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

records retention and disposition policy

records retention and disposition procedures

federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention

media protection policy

media protection procedures

audit findings

system security plan

privacy plan

privacy program plan

personally identifiable information inventory

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities

organizational personnel with information security and privacy responsibilities

network administrators

Test: Organizational processes for information management, retention, and disposition

automated mechanisms supporting and/or implementing information management, retention, and disposition
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > Assessment Objective

SI-12 Information Management and Retention - Assessment Objective
Determine if the following are satisfied:

SI-12[01] information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
SI-12[02] information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
SI-12[03] information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
SI-12[04] information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > SI-12(1) > Assessment Methods

SI-12(1) Limit Personally Identifiable Information Elements - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

personally identifiable information processing procedures

records retention and disposition policy

records retention and disposition procedures

federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to limiting personally identifiable information elements

personally identifiable information inventory

system audit records

audit findings

system security plan

privacy plan

privacy program plan

privacy impact assessment

privacy risk assessment documentation

data mapping documentation

other relevant documents or records

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities

organizational personnel with security and privacy responsibilities

network administrators

Test: Organizational processes for information management and retention (including limiting personally identifiable information processing)

automated mechanisms supporting and/or implementing limits to personally identifiable information processing
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > SI-12(1) > Assessment Objective

SI-12(1) Limit Personally Identifiable Information Elements - Assessment Objective
Determine if the following are satisfied:

personally identifiable information being processed in the information life cycle is limited to [Assignment: organization-defined elements of personally identifiable information].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > SI-12(2) > Assessment Methods

SI-12(2) Minimize Personally Identifiable Information in Testing, Training, and Research - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

personally identifiable information processing procedures

federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to minimizing the use of personally identifiable information in testing, training, and research

policy for the minimization of personally identifiable information used in testing, training, and research

procedures for the minimization of personally identifiable information used in testing, training, and research

documentation supporting minimization policy implementation (e.g., templates for testing, training, and research)

data sets used for testing, training, and research

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities

organizational personnel with information security and privacy responsibilities

network administrators

system developers

personnel with IRB responsibilities

Test: Organizational processes for the minimization of personally identifiable information used in testing, training, and research

automated mechanisms supporting and/or implementing the minimization of personally identifiable information used in testing, training, and research
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > SI-12(2) > Assessment Objective

SI-12(2) Minimize Personally Identifiable Information in Testing, Training, and Research - Assessment Objective
Determine if the following are satisfied:

SI-12(02)[01] [Assignment: organization-defined techniques] are used to minimize the use of personally identifiable information for research;
SI-12(02)[02] [Assignment: organization-defined techniques] are used to minimize the use of personally identifiable information for testing;
SI-12(02)[03] [Assignment: organization-defined techniques] are used to minimize the use of personally identifiable information for training.