ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-8 > Assessment Objective

AU-8 Time Stamps - Assessment Objective
Determine if the following are satisfied:

AU-08a. internal system clocks are used to generate timestamps for audit records;
AU-08b. timestamps are recorded for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > Assessment Methods

AU-9 Protection of Audit Information - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system configuration settings and associated documentation

system audit records

audit tools

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing audit information protection
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > Assessment Objective

AU-9 Protection of Audit Information - Assessment Objective
Determine if the following are satisfied:

AU-09a. audit information and audit logging tools are protected from unauthorized access, modification, and deletion;
AU-09b. [Assignment: organization-defined personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(1) > Assessment Methods

AU-9(1) Hardware Write-once Media - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system hardware settings

system configuration settings and associated documentation

system storage media

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: System media storing audit trails
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(1) > Assessment Objective

AU-9(1) Hardware Write-once Media - Assessment Objective
Determine if the following are satisfied:

audit trails are written to hardware-enforced, write-once media.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(2) > Assessment Methods

AU-9(2) Store on Separate Physical Systems or Components - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing protection of audit information

system design documentation

system configuration settings and associated documentation

system or media storing backups of system audit records

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing the backing up of audit records
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(2) > Assessment Objective

AU-9(2) Store on Separate Physical Systems or Components - Assessment Objective
Determine if the following are satisfied:

audit records are stored [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(3) > Assessment Methods

AU-9(3) Cryptographic Protection - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system hardware settings

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Cryptographic mechanisms protecting the integrity of audit information and tools
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(3) > Assessment Objective

AU-9(3) Cryptographic Protection - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(4) > Assessment Methods

AU-9(4) Access by Subset of Privileged Users - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system configuration settings and associated documentation

system-generated list of privileged users with access to management of audit functionality

access authorizations

access control list

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms managing access to audit functionality
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(4) > Assessment Objective

AU-9(4) Access by Subset of Privileged Users - Assessment Objective
Determine if the following are satisfied:

access to management of audit logging functionality is authorized only to [Assignment: organization-defined subset of privileged users or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(5) > Assessment Methods

AU-9(5) Dual Authorization - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system configuration settings and associated documentation

access authorizations

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms implementing the enforcement of dual authorization
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(5) > Assessment Objective

AU-9(5) Dual Authorization - Assessment Objective
Determine if the following are satisfied:

dual authorization is enforced for the [Selection; one or more: movement; deletion] of [Assignment: organization-defined audit information].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(6) > Assessment Methods

AU-9(6) Read-only Access - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system configuration settings and associated documentation

system-generated list of privileged users with read-only access to audit information

access authorizations

access control list

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms managing access to audit information
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(6) > Assessment Objective

AU-9(6) Read-only Access - Assessment Objective
Determine if the following are satisfied:

read-only access to audit information is authorized to [Assignment: organization-defined subset of privileged users or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(7) > Assessment Methods

AU-9(7) Store on Component with Different Operating System - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms implementing operating system verification capability

mechanisms verifying audit information storage location
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-9 > AU-9(7) > Assessment Objective

AU-9(7) Store on Component with Different Operating System - Assessment Objective
Determine if the following are satisfied:

audit information is stored on a component running a different operating system than the system or component being audited.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > Assessment Methods

AU-10 Non-repudiation - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing non-repudiation

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing non-repudiation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > Assessment Objective

AU-10 Non-repudiation - Assessment Objective
Determine if the following are satisfied:

irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(1) > Assessment Methods

AU-10(1) Association of Identities - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing non-repudiation

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing non-repudiation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(1) > Assessment Objective

AU-10(1) Association of Identities - Assessment Objective
Determine if the following are satisfied:

AU-10(01)(a) the identity of the information producer is bound with the information to [Assignment: organization-defined strength of binding];
AU-10(01)(b) the means for authorized individuals to determine the identity of the producer of the information is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(2) > Assessment Methods

AU-10(2) Validate Binding of Information Producer Identity - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing non-repudiation

system design documentation

system configuration settings and associated documentation

validation records

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing non-repudiation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(2) > Assessment Objective

AU-10(2) Validate Binding of Information Producer Identity - Assessment Objective
Determine if the following are satisfied:

AU-10(02)(a) the binding of the information producer identity to the information is validated at [Assignment: organization-defined frequency];
AU-10(02)(b) [Assignment: organization-defined actions] in the event of a validation error are performed.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(3) > Assessment Methods

AU-10(3) Chain of Custody - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing non-repudiation

system design documentation

system configuration settings and associated documentation

records of information reviews and releases

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Automated mechanisms implementing non-repudiation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(3) > Assessment Objective

AU-10(3) Chain of Custody - Assessment Objective
Determine if the following are satisfied:

reviewer or releaser credentials are maintained within the established chain of custody for information reviewed or released.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(4) > Assessment Methods

AU-10(4) Validate Binding of Information Reviewer Identity - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing non-repudiation

system design documentation

system configuration settings and associated documentation

validation records

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing non-repudiation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-10 > AU-10(4) > Assessment Objective

AU-10(4) Validate Binding of Information Reviewer Identity - Assessment Objective
Determine if the following are satisfied:

AU-10(04)(a) the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: organization-defined security domains] is validated;
AU-10(04)(b) [Assignment: organization-defined actions] are performed in the event of a validation error.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-11 > Assessment Methods

AU-11 Audit Record Retention - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

audit record retention policy and procedures

security plan

organization-defined retention period for audit records

audit record archives

audit logs

audit records

other relevant documents or records

Interview: Organizational personnel with audit record retention responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-11 > Assessment Objective

AU-11 Audit Record Retention - Assessment Objective
Determine if the following are satisfied:

audit records are retained for [Assignment: organization-defined time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-11 > AU-11(1) > Assessment Methods

AU-11(1) Long-term Retrieval Capability - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

audit record retention policy and procedures

system design documentation

system configuration settings and associated documentation

audit record archives

audit logs

audit records

other relevant documents or records

Interview: Organizational personnel with audit record retention responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms implementing audit record retention capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-11 > AU-11(1) > Assessment Objective

AU-11(1) Long-term Retrieval Capability - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined measures] are employed to ensure that long-term audit records generated by the system can be retrieved.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > Assessment Methods

AU-12 Audit Record Generation - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing audit record generation

system security plan

privacy plan

system design documentation

system configuration settings and associated documentation

list of auditable events

system audit records

other relevant documents or records

Interview: Organizational personnel with audit record generation responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing audit record generation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > Assessment Objective

AU-12 Audit Record Generation - Assessment Objective
Determine if the following are satisfied:

AU-12a. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignment: organization-defined system components];
AU-12b. [Assignment: organization-defined personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
AU-12c. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(1) > Assessment Methods

AU-12(1) System-wide and Time-correlated Audit Trail - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit record generation

system design documentation

system configuration settings and associated documentation

system-wide audit trail (logical or physical)

system audit records

other relevant documents or records

Interview: Organizational personnel with audit record generation responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing audit record generation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(1) > Assessment Objective

AU-12(1) System-wide and Time-correlated Audit Trail - Assessment Objective
Determine if the following are satisfied:

audit records from [Assignment: organization-defined system components] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(2) > Assessment Methods

AU-12(2) Standardized Formats - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit record generation

system design documentation

system configuration settings and associated documentation

system-wide audit trail (logical or physical)

system audit records

other relevant documents or records

Interview: Organizational personnel with audit record generation responsibilities

organizational personnel with security responsibilities

system/network administrators

system developers

Test: Mechanisms implementing audit record generation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(2) > Assessment Objective

AU-12(2) Standardized Formats - Assessment Objective
Determine if the following are satisfied:

a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(3) > Assessment Methods

AU-12(3) Changes by Authorized Individuals - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit record generation

system design documentation

system configuration settings and associated documentation

system-generated list of individuals or roles authorized to change auditing to be performed

system audit records

other relevant documents or records

Interview: Organizational personnel with audit record generation responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing audit record generation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(3) > Assessment Objective

AU-12(3) Changes by Authorized Individuals - Assessment Objective
Determine if the following are satisfied:

AU-12(03)[01] the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds] is provided;
AU-12(03)[02] the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds] is implemented.