ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-14 > Assessment Objective

AC-14 Permitted Actions Without Identification or Authentication - Assessment Objective
Determine if the following are satisfied:

AC-14a. [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified;
AC-14b.[01] user actions not requiring identification or authentication are documented in the security plan for the system;
AC-14b.[02] a rationale for user actions not requiring identification or authentication is provided in the security plan for the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > Assessment Methods

AC-16 Security and Privacy Attributes - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the association of security and privacy attributes to information in storage, in process, and in transmission

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Organizational capability supporting and maintaining the association of security and privacy attributes to information in storage, in process, and in transmission
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > Assessment Objective

AC-16 Security and Privacy Attributes - Assessment Objective
Determine if the following are satisfied:

AC-16a.[01] the means to associate [Assignment: organization-defined types of security attributes] with [Assignment: organization-defined security attribute values] for information in storage, in process, and/or in transmission are provided;
AC-16a.[02] the means to associate [Assignment: organization-defined types of privacy attributes] with [Assignment: organization-defined privacy attribute values] for information in storage, in process, and/or in transmission are provided;
AC-16b.[01] attribute associations are made;
AC-16b.[02] attribute associations are retained with the information;
AC-16c.[01] the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [Assignment: organization-defined systems]: [Assignment: organization-defined security attributes];
AC-16c.[02] the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [Assignment: organization-defined systems]: [Assignment: organization-defined privacy attributes];
AC-16d. the following permitted attribute values or ranges for each of the established attributes are determined: [Assignment: organization-defined attribute values or ranges];
AC-16e. changes to attributes are audited;
AC-16f.[01] [Assignment: organization-defined security attributes] are reviewed for applicability [Assignment: organization-defined frequency];
AC-16f.[02] [Assignment: organization-defined privacy attributes] are reviewed for applicability [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(1) > Assessment Methods

AC-16(1) Dynamic Attribute Association - Assessment Methods and Objects

Examine: Access control policy

procedures addressing dynamic association of security and privacy attributes to information

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Automated mechanisms implementing dynamic association of security and privacy attributes to information
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(1) > Assessment Objective

AC-16(1) Dynamic Attribute Association - Assessment Objective
Determine if the following are satisfied:

AC-16(01)[01] security attributes are dynamically associated with [Assignment: organization-defined subjects] in accordance with the following security policies as information is created and combined: [Assignment: organization-defined security policies];
AC-16(01)[02] security attributes are dynamically associated with [Assignment: organization-defined objects] in accordance with the following security policies as information is created and combined: [Assignment: organization-defined security policies];
AC-16(01)[03] privacy attributes are dynamically associated with [Assignment: organization-defined subjects] in accordance with the following privacy policies as information is created and combined: [Assignment: organization-defined privacy policies];
AC-16(01)[04] privacy attributes are dynamically associated with [Assignment: organization-defined objects] in accordance with the following privacy policies as information is created and combined: [Assignment: organization-defined privacy policies].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(2) > Assessment Methods

AC-16(2) Attribute Value Changes by Authorized Individuals - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the change of security and privacy attribute values

system design documentation

system configuration settings and associated documentation

list of individuals authorized to change security and privacy attributes

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for changing values of security and privacy attributes

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms permitting changes to values of security and privacy attributes
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(2) > Assessment Objective

AC-16(2) Attribute Value Changes by Authorized Individuals - Assessment Objective
Determine if the following are satisfied:

AC-16(02)[01] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes;
AC-16(02)[02] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(3) > Assessment Methods

AC-16(3) Maintenance of Attribute Associations by System - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the association of security and privacy attributes to information

procedures addressing labeling or marking

system design documentation

system configuration settings and associated documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms maintaining association and integrity of security and privacy attributes to information
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(3) > Assessment Objective

AC-16(3) Maintenance of Attribute Associations by System - Assessment Objective
Determine if the following are satisfied:

AC-16(03)[01] the association and integrity of [Assignment: organization-defined security attributes] to [Assignment: organization-defined subjects] is maintained;
AC-16(03)[02] the association and integrity of [Assignment: organization-defined security attributes] to [Assignment: organization-defined objects] is maintained.
AC-16(03)[03] the association and integrity of [Assignment: organization-defined privacy attributes] to [Assignment: organization-defined subjects] is maintained;
AC-16(03)[04] the association and integrity of [Assignment: organization-defined privacy attributes] to [Assignment: organization-defined objects] is maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(4) > Assessment Methods

AC-16(4) Association of Attributes by Authorized Individuals - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the association of security and privacy attributes to information

system design documentation

system configuration settings and associated documentation

list of users authorized to associate security and privacy attributes to information

system prompts for privileged users to select security and privacy attributes to be associated with information objects

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for associating security and privacy attributes to information

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms supporting user associations of security and privacy attributes to information
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(4) > Assessment Objective

AC-16(4) Association of Attributes by Authorized Individuals - Assessment Objective
Determine if the following are satisfied:

AC-16(04)[01] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: organization-defined security attributes] with [Assignment: organization-defined subjects];
AC-16(04)[02] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: organization-defined security attributes] with [Assignment: organization-defined objects];
AC-16(04)[03] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: organization-defined privacy attributes] with [Assignment: organization-defined subjects];
AC-16(04)[04] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: organization-defined privacy attributes] with [Assignment: organization-defined objects].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(5) > Assessment Methods

AC-16(5) Attribute Displays on Objects to Be Output - Assessment Methods and Objects

Examine: Access control policy

procedures addressing display of security and privacy attributes in human-readable form

special dissemination, handling, or distribution instructions

types of human-readable, standard naming conventions

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system developers

Test: System output devices displaying security and privacy attributes in human-readable form on each object
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(5) > Assessment Objective

AC-16(5) Attribute Displays on Objects to Be Output - Assessment Objective
Determine if the following are satisfied:

AC-16(05)[01] security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined instructions] using [Assignment: organization-defined naming conventions];
AC-16(05)[02] privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined instructions] using [Assignment: organization-defined naming conventions].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(6) > Assessment Methods

AC-16(6) Maintenance of Attribute Association - Assessment Methods and Objects

Examine: Access control policy

procedures addressing association of security and privacy attributes with subjects and objects

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for associating and maintaining association of security and privacy attributes with subjects and objects

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms supporting associations of security and privacy attributes to subjects and objects
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(6) > Assessment Objective

AC-16(6) Maintenance of Attribute Association - Assessment Objective
Determine if the following are satisfied:

AC-16(06)[01] personnel are required to associate and maintain the association of [Assignment: organization-defined security attributes] with [Assignment: organization-defined subjects] in accordance with [Assignment: organization-defined security policies];
AC-16(06)[02] personnel are required to associate and maintain the association of [Assignment: organization-defined security attributes] with [Assignment: organization-defined objects] in accordance with [Assignment: organization-defined security policies];
AC-16(06)[03] personnel are required to associate and maintain the association of [Assignment: organization-defined privacy attributes] with [Assignment: organization-defined subjects] in accordance with [Assignment: organization-defined privacy policies];
AC-16(06)[04] personnel are required to associate and maintain the association of [Assignment: organization-defined privacy attributes] with [Assignment: organization-defined objects] in accordance with [Assignment: organization-defined privacy policies].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(7) > Assessment Methods

AC-16(7) Consistent Attribute Interpretation - Assessment Methods and Objects

Examine: Access control policies and procedures

procedures addressing consistent interpretation of security and privacy attributes transmitted between distributed system components

procedures addressing access enforcement

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy access control policy

other relevant documents or records

Interview: Organizational personnel with responsibilities for providing consistent interpretation of security and privacy attributes used in access enforcement and information flow enforcement actions

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing access enforcement and information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(7) > Assessment Objective

AC-16(7) Consistent Attribute Interpretation - Assessment Objective
Determine if the following are satisfied:

AC-16(07)[01] a consistent interpretation of security attributes transmitted between distributed system components is provided;
AC-16(07)[02] a consistent interpretation of privacy attributes transmitted between distributed system components is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(8) > Assessment Methods

AC-16(8) Association Techniques and Technologies - Assessment Methods and Objects

Examine: Access control policy

procedures addressing association of security and privacy attributes to information

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for associating security and privacy attributes to information

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing techniques or technologies associating security and privacy attributes to information
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(8) > Assessment Objective

AC-16(8) Association Techniques and Technologies - Assessment Objective
Determine if the following are satisfied:

AC-16(08)[01] [Assignment: organization-defined techniques and technologies] are implemented in associating security attributes to information;
AC-16(08)[02] [Assignment: organization-defined techniques and technologies] are implemented in associating privacy attributes to information.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(9) > Assessment Methods

AC-16(9) Attribute Reassignment - Regrading Mechanisms - Assessment Methods and Objects

Examine: Access control policy

procedures addressing reassignment of security attributes to information

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for reassigning association of security and privacy attributes to information

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing techniques or procedures for reassigning association of security and privacy attributes to information
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(9) > Assessment Objective

AC-16(9) Attribute Reassignment - Regrading Mechanisms - Assessment Objective
Determine if the following are satisfied:

AC-16(09)[01] security attributes associated with information are changed only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures];
AC-16(09)[02] privacy attributes associated with information are changed only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(10) > Assessment Methods

AC-16(10) Attribute Configuration by Authorized Individuals - Assessment Methods and Objects

Examine: Access control policy

procedures addressing configuration of security and privacy attributes by authorized individuals

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining or changing security and privacy attributes associated with information

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing capability for defining or changing security and privacy attributes
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-16 > AC-16(10) > Assessment Objective

AC-16(10) Attribute Configuration by Authorized Individuals - Assessment Objective
Determine if the following are satisfied:

AC-16(10)[01] authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects;
AC-16(10)[02] authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > Assessment Methods

AC-17 Remote Access - Assessment Methods and Objects

Examine: Access control policy

procedures addressing remote access implementation and usage (including restrictions)

configuration management plan

system configuration settings and associated documentation

remote access authorizations

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing remote access connections

system/network administrators

organizational personnel with information security responsibilities

Test: Remote access management capability for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > Assessment Objective

AC-17 Remote Access - Assessment Objective
Determine if the following are satisfied:

AC-17a.[01] usage restrictions are established and documented for each type of remote access allowed;
AC-17a.[02] configuration/connection requirements are established and documented for each type of remote access allowed;
AC-17a.[03] implementation guidance is established and documented for each type of remote access allowed;
AC-17b. each type of remote access to the system is authorized prior to allowing such connections.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(1) > Assessment Methods

AC-17(1) Monitoring and Control - Assessment Methods and Objects

Examine: Access control policy

procedures addressing remote access to the system

system design documentation

system configuration settings and associated documentation

system audit records

system monitoring records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Automated mechanisms monitoring and controlling remote access methods
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(1) > Assessment Objective

AC-17(1) Monitoring and Control - Assessment Objective
Determine if the following are satisfied:

AC-17(01)[01] automated mechanisms are employed to monitor remote access methods;
AC-17(01)[02] automated mechanisms are employed to control remote access methods.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(2) > Assessment Methods

AC-17(2) Protection of Confidentiality and Integrity Using Encryption - Assessment Methods and Objects

Examine: Access control policy

procedures addressing remote access to the system

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated configuration documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Cryptographic mechanisms protecting confidentiality and integrity of remote access sessions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(2) > Assessment Objective

AC-17(2) Protection of Confidentiality and Integrity Using Encryption - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions.