ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-4 > Assessment Objective

PM-4 Plan of Action and Milestones Process - Assessment Objective
Determine if the following are satisfied:

PM-04a.01[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;
PM-04a.01[02] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;
PM-04a.01[03] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;
PM-04a.01[04] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;
PM-04a.01[05] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;
PM-04a.01[06] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;
PM-04a.02[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
PM-04a.02[02] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
PM-04a.02[03] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
PM-04a.03[01] a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
PM-04a.03[02] a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
PM-04a.03[03] a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
PM-04b.[01] plans of action and milestones are reviewed for consistency with the organizational risk management strategy;
PM-04b.[02] plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-5 > Assessment Methods

PM-5 System Inventory - Assessment Methods and Objects

Examine: Information security program plan

system inventory

procedures addressing system inventory development and maintenance

OMB FISMA reporting guidance

other relevant documents or records

Interview: Organizational personnel with information security program planning and plan implementation responsibilities

organizational personnel responsible for developing and maintaining the system inventory

organizational personnel with information security responsibilities

Test: Organizational processes for system inventory development and maintenance

mechanisms supporting the system inventory
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-5 > Assessment Objective

PM-5 System Inventory - Assessment Objective
Determine if the following are satisfied:

PM-05[01] an inventory of organizational systems is developed;
PM-05[02] the inventory of organizational systems is updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-5 > PM-5(1) > Assessment Methods

PM-5(1) Inventory of Personally Identifiable Information - Assessment Methods and Objects

Examine: Procedures addressing system inventory development, maintenance, and updates

OMB FISMA reporting guidance

privacy program plan

information security program plan

personally identifiable information processing policy

system inventory

personally identifiable information inventory

data mapping documentation

other relevant documents or records

Interview: Organizational personnel with privacy program planning and plan implementation responsibilities

organizational personnel responsible for developing and maintaining the system inventory

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for system inventory development, maintenance, and updates

mechanisms supporting the system inventory
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-5 > PM-5(1) > Assessment Objective

PM-5(1) Inventory of Personally Identifiable Information - Assessment Objective
Determine if the following are satisfied:

PM-05(01)[01] an inventory of all systems, applications, and projects that process personally identifiable information is established;
PM-05(01)[02] an inventory of all systems, applications, and projects that process personally identifiable information is maintained;
PM-05(01)[03] an inventory of all systems, applications, and projects that process personally identifiable information is updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-6 > Assessment Methods

PM-6 Measures of Performance - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

information security measures of performance

privacy measures of performance

procedures addressing the development, monitoring, and reporting of information security and privacy measures of performance

risk management strategy

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for developing, monitoring, and reporting information security and privacy measures of performance

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for developing, monitoring, and reporting information security and privacy measures of performance

mechanisms supporting the development, monitoring, and reporting of information security and privacy measures of performance
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-6 > Assessment Objective

PM-6 Measures of Performance - Assessment Objective
Determine if the following are satisfied:

PM-06[01] information security measures of performance are developed;
PM-06[02] information security measures of performance are monitored;
PM-06[03] the results of information security measures of performance are reported;
PM-06[04] privacy measures of performance are developed;
PM-06[05] privacy measures of performance are monitored;
PM-06[06] the results of privacy measures of performance are reported.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-7 > Assessment Methods

PM-7 Enterprise Architecture - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

enterprise architecture documentation

procedures addressing enterprise architecture development

results of risk assessments of enterprise architecture

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for developing enterprise architecture

organizational personnel responsible for risk assessments of enterprise architecture

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for enterprise architecture development

mechanisms supporting the enterprise architecture and its development
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-7 > Assessment Objective

PM-7 Enterprise Architecture - Assessment Objective
Determine if the following are satisfied:

PM-07[01] an enterprise architecture is developed with consideration for information security;
PM-07[02] an enterprise architecture is maintained with consideration for information security;
PM-07[03] an enterprise architecture is developed with consideration for privacy;
PM-07[04] an enterprise architecture is maintained with consideration for privacy;
PM-07[05] an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;
PM-07[06] an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-7 > PM-7(1) > Assessment Methods

PM-7(1) Offloading - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

enterprise architecture documentation

procedures addressing enterprise architecture development

procedures for identifying and offloading functions or services

results of risk assessments of enterprise architecture

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for developing enterprise architecture

organizational personnel responsible for risk assessments of enterprise architecture

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for enterprise architecture development

mechanisms supporting the enterprise architecture and its development

mechanisms for offloading functions and services
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-7 > PM-7(1) > Assessment Objective

PM-7(1) Offloading - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined non-essential functions or services] are offloaded to other systems, system components, or an external provider.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-8 > Assessment Methods

PM-8 Critical Infrastructure Plan - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

critical infrastructure and key resources protection plan

procedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan

HSPD 7

National Infrastructure Protection Plan

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for developing, documenting, and updating the critical infrastructure and key resources protection plan

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for developing, documenting, and updating the critical infrastructure and key resources protection plan

mechanisms supporting the development, documentation, and updating of the critical infrastructure and key resources protection plan
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-8 > Assessment Objective

PM-8 Critical Infrastructure Plan - Assessment Objective
Determine if the following are satisfied:

PM-08[01] information security issues are addressed in the development of a critical infrastructure and key resources protection plan;
PM-08[02] information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
PM-08[03] information security issues are addressed in the update of a critical infrastructure and key resources protection plan;
PM-08[04] privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;
PM-08[05] privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
PM-08[06] privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-9 > Assessment Methods

PM-9 Risk Management Strategy - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

risk management strategy

supply chain risk management strategy

procedures addressing the development, implementation, review, and update of the risk management strategy

risk assessment results relevant to the risk management strategy

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for the development, implementation, review, and update of the risk management strategy

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for the development, implementation, review, and update of the risk management strategy

mechanisms supporting the development, implementation, review, and update of the risk management strategy
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-9 > Assessment Objective

PM-9 Risk Management Strategy - Assessment Objective
Determine if the following are satisfied:

PM-09a.01 a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;
PM-09a.02 a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;
PM-09b. the risk management strategy is implemented consistently across the organization;
PM-09c. the risk management strategy is reviewed and updated [Assignment: organization-defined frequency] or as required to address organizational changes.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-10 > Assessment Methods

PM-10 Authorization Process - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process

assessment, authorization, and monitoring policy

assessment, authorization, and monitoring procedures

system authorization documentation

lists or other documentation about authorization process roles and responsibilities

risk assessment results relevant to the authorization process and the organization-wide risk management program

organizational risk management strategy

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for management of the authorization process

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for authorization

mechanisms supporting the authorization process
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-10 > Assessment Objective

PM-10 Authorization Process - Assessment Objective
Determine if the following are satisfied:

PM-10a.[01] the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;
PM-10a.[02] the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;
PM-10b. individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;
PM-10c. the authorization processes are integrated into an organization-wide risk management program.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-11 > Assessment Methods

PM-11 Mission and Business Process Definition - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

risk management strategy

procedures for determining mission and business protection needs

information security and privacy risk assessment results relevant to the determination of mission and business protection needs

personally identifiable information processing policy

personally identifiable information inventory

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for enterprise risk management

organizational personnel responsible for determining information protection needs for mission and business processes

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for defining mission and business processes and their information protection needs
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-11 > Assessment Objective

PM-11 Mission and Business Process Definition - Assessment Objective
Determine if the following are satisfied:

PM-11a.[01] organizational mission and business processes are defined with consideration for information security;
PM-11a.[02] organizational mission and business processes are defined with consideration for privacy;
PM-11a.[03] organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
PM-11b.[01] information protection needs arising from the defined mission and business processes are determined;
PM-11b.[02] personally identifiable information processing needs arising from the defined mission and business processes are determined;
PM-11c. the mission and business processes are reviewed and revised [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-12 > Assessment Methods

PM-12 Insider Threat Program - Assessment Methods and Objects

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for the insider threat program

members of the cross-discipline insider threat incident handling team

legal counsel

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for implementing the insider threat program and the cross-discipline insider threat incident handling team

mechanisms supporting and/or implementing the insider threat program and the cross-discipline insider threat incident handling team
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-12 > Assessment Objective

PM-12 Insider Threat Program - Assessment Objective
Determine if the following are satisfied:

an insider threat program that includes a cross-discipline insider threat incident handling team is implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-13 > Assessment Methods

PM-13 Security and Privacy Workforce - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

information security and privacy workforce development and improvement program documentation

procedures for the information security and privacy workforce development and improvement program

information security and privacy role-based training program documentation

other relevant documents or records

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for the information security and privacy workforce development and improvement program

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for implementing the information security and privacy workforce development and improvement program

mechanisms supporting and/or implementing the information security and privacy workforce development and improvement program
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-13 > Assessment Objective

PM-13 Security and Privacy Workforce - Assessment Objective
Determine if the following are satisfied:

PM-13[01] a security workforce development and improvement program is established;
PM-13[02] a privacy workforce development and improvement program is established.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-14 > Assessment Methods

PM-14 Testing, Training, and Monitoring - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

plans for conducting security and privacy testing, training, and monitoring activities

organizational procedures addressing the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities

risk management strategy

procedures for the review of plans for conducting security and privacy testing, training, and monitoring activities for consistency with risk management strategy and risk response priorities

results of risk assessments associated with conducting security and privacy testing, training, and monitoring activities

documentation of the timely execution of plans for conducting security and privacy testing, training, and monitoring activities

other relevant documents or records

Interview: Organizational personnel with responsibilities for developing and maintaining plans for conducting security and privacy testing, training, and monitoring activities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities

mechanisms supporting the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities