ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(2) > Assessment Methods

CP-4(2) Alternate Processing Site - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency plan testing

contingency plan

contingency plan test documentation

contingency plan test results

alternate processing site agreements

service-level agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for contingency plan testing

mechanisms supporting the contingency plan and/or contingency plan testing
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(2) > Assessment Objective

CP-4(2) Alternate Processing Site - Assessment Objective
Determine if the following are satisfied:

CP-04(02)(a) the contingency plan is tested at the alternate processing site to familiarize contingency personnel with the facility and available resources;
CP-04(02)(b) the contingency plan is tested at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(3) > Assessment Methods

CP-4(3) Automated Testing - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency plan testing

contingency plan

automated mechanisms supporting contingency plan testing

contingency plan test documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan testing responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for contingency plan testing

automated mechanisms supporting contingency plan testing
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(3) > Assessment Objective

CP-4(3) Automated Testing - Assessment Objective
Determine if the following are satisfied:

the contingency plan is tested using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(4) > Assessment Methods

CP-4(4) Full Recovery and Reconstitution - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system recovery and reconstitution

contingency plan

contingency plan test documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan testing responsibilities

organizational personnel with system recovery and reconstitution responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for contingency plan testing

mechanisms supporting contingency plan testing

mechanisms supporting recovery and reconstitution of the system
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(4) > Assessment Objective

CP-4(4) Full Recovery and Reconstitution - Assessment Objective
Determine if the following are satisfied:

CP-04(04)[01] a full recovery of the system to a known state is included as part of contingency plan testing;
CP-04(04)[02] a full reconstitution of the system to a known state is included as part of contingency plan testing.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(5) > Assessment Methods

CP-4(5) Self-challenge - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system recovery and reconstitution

contingency plan

contingency plan test documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan testing responsibilities

organizational personnel with system recovery and reconstitution responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for contingency plan testing

mechanisms supporting contingency plan testing
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(5) > Assessment Objective

CP-4(5) Self-challenge - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined mechanisms] are employed to disrupt and adversely affect the [Assignment: organization-defined system or system component].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > Assessment Methods

CP-6 Alternate Storage Site - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate storage sites

contingency plan

alternate storage site agreements

primary storage site agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan alternate storage site responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for storing and retrieving system backup information at the alternate storage site

mechanisms supporting and/or implementing the storage and retrieval of system backup information at the alternate storage site
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > Assessment Objective

CP-6 Alternate Storage Site - Assessment Objective
Determine if the following are satisfied:

CP-06a.[01] an alternate storage site is established;
CP-06a.[02] establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information;
CP-06b. the alternate storage site provides controls equivalent to that of the primary site.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > CP-6(1) > Assessment Methods

CP-6(1) Separation from Primary Site - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate storage sites

contingency plan

alternate storage site

alternate storage site agreements

primary storage site agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan alternate storage site responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > CP-6(1) > Assessment Objective

CP-6(1) Separation from Primary Site - Assessment Objective
Determine if the following are satisfied:

an alternate storage site that is sufficiently separated from the primary storage site is identified to reduce susceptibility to the same threats.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > CP-6(2) > Assessment Methods

CP-6(2) Recovery Time and Recovery Point Objectives - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate storage sites

contingency plan

alternate storage site

alternate storage site agreements

alternate storage site configurations

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan testing responsibilities

organizational personnel with responsibilities for testing related plans

organizational personnel with information security responsibilities

Test: Organizational processes for contingency plan testing

mechanisms supporting recovery time and point objectives
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > CP-6(2) > Assessment Objective

CP-6(2) Recovery Time and Recovery Point Objectives - Assessment Objective
Determine if the following are satisfied:

CP-06(02)[01] the alternate storage site is configured to facilitate recovery operations in accordance with recovery time objectives;
CP-06(02)[02] the alternate storage site is configured to facilitate recovery operations in accordance with recovery point objectives.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > CP-6(3) > Assessment Methods

CP-6(3) Accessibility - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate storage sites

contingency plan

alternate storage site

list of potential accessibility problems to alternate storage site

mitigation actions for accessibility problems to alternate storage site

organizational risk assessments

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan alternate storage site responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-6 > CP-6(3) > Assessment Objective

CP-6(3) Accessibility - Assessment Objective
Determine if the following are satisfied:

CP-06(03)[01] potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified;
CP-06(03)[02] explicit mitigation actions to address identified accessibility problems are outlined.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > Assessment Methods

CP-7 Alternate Processing Site - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate processing sites

contingency plan

alternate processing site agreements

primary processing site agreements

spare equipment and supplies inventory at alternate processing site

equipment and supply contracts

service-level agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for contingency planning and/or alternate site arrangements

organizational personnel with information security responsibilities

Test: Organizational processes for recovery at the alternate site

mechanisms supporting and/or implementing recovery at the alternate processing site
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > Assessment Objective

CP-7 Alternate Processing Site - Assessment Objective
Determine if the following are satisfied:

CP-07a. an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and business functions, is established within [Assignment: organization-defined time period] when the primary processing capabilities are unavailable;
CP-07b.[01] the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [Assignment: organization-defined time period] for transfer;
CP-07b.[02] the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [Assignment: organization-defined time period] for resumption;
CP-07c. controls provided at the alternate processing site are equivalent to those at the primary site.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(1) > Assessment Methods

CP-7(1) Separation from Primary Site - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate processing sites

contingency plan

alternate processing site

alternate processing site agreements

primary processing site agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan alternate processing site responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(1) > Assessment Objective

CP-7(1) Separation from Primary Site - Assessment Objective
Determine if the following are satisfied:

an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats is identified.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(2) > Assessment Methods

CP-7(2) Accessibility - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate processing sites

contingency plan

alternate processing site

alternate processing site agreements

primary processing site agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan alternate processing site responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(2) > Assessment Objective

CP-7(2) Accessibility - Assessment Objective
Determine if the following are satisfied:

CP-07(02)[01] potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster are identified;
CP-07(02)[02] explicit mitigation actions to address identified accessibility problems are outlined.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(3) > Assessment Methods

CP-7(3) Priority of Service - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate processing sites

contingency plan

alternate processing site agreements

service-level agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan alternate processing site responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities

organizational personnel with responsibility for acquisitions/contractual agreements
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(3) > Assessment Objective

CP-7(3) Priority of Service - Assessment Objective
Determine if the following are satisfied:

alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(4) > Assessment Methods

CP-7(4) Preparation for Use - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate processing sites

contingency plan

alternate processing site

alternate processing site agreements

alternate processing site configurations

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan alternate processing site responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing recovery at the alternate processing site
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(4) > Assessment Objective

CP-7(4) Preparation for Use - Assessment Objective
Determine if the following are satisfied:

the alternate processing site is prepared so that the site can serve as the operational site supporting essential mission and business functions.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(6) > Assessment Methods

CP-7(6) Inability to Return to Primary Site - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate processing sites

contingency plan

alternate processing site

alternate processing site agreements

alternate processing site configurations

system security plan

other relevant documents or records

Interview: Organizational personnel with system reconstitution responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-7 > CP-7(6) > Assessment Objective

CP-7(6) Inability to Return to Primary Site - Assessment Objective
Determine if the following are satisfied:

CP-07(06)[01] circumstances that preclude returning to the primary processing site are planned for;
CP-07(06)[02] circumstances that preclude returning to the primary processing site are prepared for.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > Assessment Methods

CP-8 Telecommunications Services - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate telecommunications services

contingency plan

primary and alternate telecommunications service agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan telecommunications responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with knowledge of requirements for mission and business functions

organizational personnel with information security responsibilities

organizational personnel with responsibility for acquisitions/contractual agreements

Test: Mechanisms supporting telecommunications
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > Assessment Objective

CP-8 Telecommunications Services - Assessment Objective
Determine if the following are satisfied:

alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] , are established for essential mission and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(1) > Assessment Methods

CP-8(1) Priority of Service Provisions - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing primary and alternate telecommunications services

contingency plan

primary and alternate telecommunications service agreements

Telecommunications Service Priority documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan telecommunications responsibilities

organizational personnel with system recovery responsibilities

organizational personnel with information security responsibilities

organizational personnel with responsibility for acquisitions/contractual agreements

Test: Mechanisms supporting telecommunications
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(1) > Assessment Objective

CP-8(1) Priority of Service Provisions - Assessment Objective
Determine if the following are satisfied:

CP-08(01)(a)[01] primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed;
CP-08(01)(a)[02] alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed;
CP-08(01)(b) Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(2) > Assessment Methods

CP-8(2) Single Points of Failure - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing primary and alternate telecommunications services

contingency plan

primary and alternate telecommunications service agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan telecommunications responsibilities

organizational personnel with system recovery responsibilities

primary and alternate telecommunications service providers

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(2) > Assessment Objective

CP-8(2) Single Points of Failure - Assessment Objective
Determine if the following are satisfied:

alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(3) > Assessment Methods

CP-8(3) Separation of Primary and Alternate Providers - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing primary and alternate telecommunications services

contingency plan

primary and alternate telecommunications service agreements

alternate telecommunications service provider site

primary telecommunications service provider site

other relevant documents or records

Interview: Organizational personnel with contingency plan telecommunications responsibilities

organizational personnel with system recovery responsibilities

primary and alternate telecommunications service providers

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(3) > Assessment Objective

CP-8(3) Separation of Primary and Alternate Providers - Assessment Objective
Determine if the following are satisfied:

alternate telecommunications services from providers that are separated from primary service providers are obtained to reduce susceptibility to the same threats.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(4) > Assessment Methods

CP-8(4) Provider Contingency Plan - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing primary and alternate telecommunications services

contingency plan

provider contingency plans

evidence of contingency testing/training by providers

primary and alternate telecommunications service agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning, plan implementation, and testing responsibilities

primary and alternate telecommunications service providers

organizational personnel with information security responsibilities

organizational personnel with responsibility for acquisitions/contractual agreements