ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(2) > Discussion

AC-16(2) Attribute Value Changes by Authorized Individuals - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

The content or assigned values of attributes can directly affect the ability of individuals to access organizational information. Therefore, it is important for systems to be able to limit the ability to create or modify attributes to authorized individuals.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(2)

AC-16(2) Security and Privacy Attributes | Attribute Value Changes by Authorized Individuals
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(3) > Discussion

AC-16(3) Maintenance of Attribute Associations by System - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Maintaining the association and integrity of security and privacy attributes to subjects and objects with sufficient assurance helps to ensure that the attribute associations can be used as the basis of automated policy actions. The integrity of specific items, such as security configuration files, may be maintained through the use of an integrity monitoring mechanism that detects anomalies and changes that deviate from "known good" baselines. Automated policy actions include retention date expirations, access control decisions, information flow control decisions, and information disclosure decisions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(3)

AC-16(3) Security and Privacy Attributes | Maintenance of Attribute Associations by System
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Maintain the association and integrity of [Assignment: organization-defined organization-defined security and privacy attributes] to [Assignment: organization-defined organization-defined subjects and objects].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(4) > Discussion

AC-16(4) Association of Attributes by Authorized Individuals - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Systems, in general, provide the capability for privileged users to assign security and privacy attributes to system-defined subjects (e.g., users) and objects (e.g., directories, files, and ports). Some systems provide additional capability for general users to assign security and privacy attributes to additional objects (e.g., files, emails). The association of attributes by authorized individuals is described in the design documentation. The support provided by systems can include prompting users to select security and privacy attributes to be associated with information objects, employing automated mechanisms to categorize information with attributes based on defined policies, or ensuring that the combination of the security or privacy attributes selected is valid. Organizations consider the creation, deletion, or modification of attributes when defining auditable events.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(4)

AC-16(4) Security and Privacy Attributes | Association of Attributes by Authorized Individuals
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Provide the capability to associate [Assignment: organization-defined organization-defined security and privacy attributes] with [Assignment: organization-defined organization-defined subjects and objects] by authorized individuals (or processes acting on behalf of individuals).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(5) > Discussion

AC-16(5) Attribute Displays on Objects to Be Output - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

System outputs include printed pages, screens, or equivalent items. System output devices include printers, notebook computers, video displays, smart phones, and tablets. To mitigate the risk of unauthorized exposure of information (e.g., shoulder surfing), the outputs display full attribute values when unmasked by the subscriber.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(5)

AC-16(5) Security and Privacy Attributes | Attribute Displays on Objects to Be Output
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined instructions] using [Assignment: organization-defined naming conventions].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(6) > Discussion

AC-16(6) Maintenance of Attribute Association - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Maintaining attribute association requires individual users (as opposed to the system) to maintain associations of defined security and privacy attributes with subjects and objects.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(6)

AC-16(6) Security and Privacy Attributes | Maintenance of Attribute Association
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Require personnel to associate and maintain the association of [Assignment: organization-defined organization-defined security and privacy attributes] with [Assignment: organization-defined organization-defined subjects and objects] in accordance with [Assignment: organization-defined organization-defined security and privacy policies].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(7) > Discussion

AC-16(7) Consistent Attribute Interpretation - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

To enforce security and privacy policies across multiple system components in distributed systems, organizations provide a consistent interpretation of security and privacy attributes employed in access enforcement and flow enforcement decisions. Organizations can establish agreements and processes to help ensure that distributed system components implement attributes with consistent interpretations in automated access enforcement and flow enforcement actions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(7)

AC-16(7) Security and Privacy Attributes | Consistent Attribute Interpretation
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(8) > Discussion

AC-16(8) Association Techniques and Technologies - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

The association of security and privacy attributes to information within systems is important for conducting automated access enforcement and flow enforcement actions. The association of such attributes to information (i.e., binding) can be accomplished with technologies and techniques that provide different levels of assurance. For example, systems can cryptographically bind attributes to information using digital signatures that support cryptographic keys protected by hardware devices (sometimes known as hardware roots of trust).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(8)

AC-16(8) Security and Privacy Attributes | Association Techniques and Technologies
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Implement [Assignment: organization-defined organization-defined techniques and technologies] in associating security and privacy attributes to information.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(9) > Discussion

AC-16(9) Attribute Reassignment - Regrading Mechanisms - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

A regrading mechanism is a trusted process authorized to re-classify and re-label data in accordance with a defined policy exception. Validated regrading mechanisms are used by organizations to provide the requisite levels of assurance for attribute reassignment activities. The validation is facilitated by ensuring that regrading mechanisms are single purpose and of limited function. Since security and privacy attribute changes can directly affect policy enforcement actions, implementing trustworthy regrading mechanisms is necessary to help ensure that such mechanisms perform in a consistent and correct mode of operation.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(9)

AC-16(9) Security and Privacy Attributes | Attribute Reassignment - Regrading Mechanisms
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Change security and privacy attributes associated with information only via regrading mechanisms validated using [Assignment: organization-defined organization-defined techniques or procedures].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(10) > Discussion

AC-16(10) Attribute Configuration by Authorized Individuals - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

The content or assigned values of security and privacy attributes can directly affect the ability of individuals to access organizational information. Thus, it is important for systems to be able to limit the ability to create or modify the type and value of attributes available for association with subjects and objects to authorized individuals only.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(10)

AC-16(10) Security and Privacy Attributes | Attribute Configuration by Authorized Individuals
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17

AC-17 Remote Access
Family: Access Control (AC)

a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
b. Authorize each type of remote access to the system prior to allowing such connections.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > Discussion

AC-17 Remote Access - Discussion
Family: Access Control (AC)

Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of [CA-3](#ca-3) . Enforcing access restrictions for remote access is addressed via [AC-3](#ac-3).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(1) > Discussion

AC-17(1) Monitoring and Control - Discussion
Family: Access Control (AC) > AC-17 Remote Access

Monitoring and control of remote access methods allows organizations to detect attacks and help ensure compliance with remote access policies by auditing the connection activities of remote users on a variety of system components, including servers, notebook computers, workstations, smart phones, and tablets. Audit logging for remote access is enforced by [AU-2](#au-2) . Audit events are defined in [AU-2a](#au-2_smt.a).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(1)

AC-17(1) Remote Access | Monitoring and Control
Family: Access Control (AC) > AC-17 Remote Access

Employ automated mechanisms to monitor and control remote access methods.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(2) > Discussion

AC-17(2) Protection of Confidentiality and Integrity Using Encryption - Discussion
Family: Access Control (AC) > AC-17 Remote Access

Virtual private networks can be used to protect the confidentiality and integrity of remote access sessions. Transport Layer Security (TLS) is an example of a cryptographic protocol that provides end-to-end communications security over networks and is used for Internet communications and online transactions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(2)

AC-17(2) Remote Access | Protection of Confidentiality and Integrity Using Encryption
Family: Access Control (AC) > AC-17 Remote Access

Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(3) > Discussion

AC-17(3) Managed Access Control Points - Discussion
Family: Access Control (AC) > AC-17 Remote Access

Organizations consider the Trusted Internet Connections (TIC) initiative [DHS TIC](#4f42ee6e-86cc-403b-a51f-76c2b4f81b54) requirements for external network connections since limiting the number of access control points for remote access reduces attack surfaces.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(3)

AC-17(3) Remote Access | Managed Access Control Points
Family: Access Control (AC) > AC-17 Remote Access

Route remote accesses through authorized and managed network access control points.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(4) > Discussion

AC-17(4) Privileged Commands and Access - Discussion
Family: Access Control (AC) > AC-17 Remote Access

Remote access to systems represents a significant potential vulnerability that can be exploited by adversaries. As such, restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and the susceptibility to threats by adversaries to the remote access capability.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(4)

AC-17(4) Remote Access | Privileged Commands and Access
Family: Access Control (AC) > AC-17 Remote Access

(a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined organization-defined needs] ; and
(b) Document the rationale for remote access in the security plan for the system.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(6) > Discussion

AC-17(6) Protection of Mechanism Information - Discussion
Family: Access Control (AC) > AC-17 Remote Access

Remote access to organizational information by non-organizational entities can increase the risk of unauthorized use and disclosure about remote access mechanisms. The organization considers including remote access requirements in the information exchange agreements with other organizations, as applicable. Remote access requirements can also be included in rules of behavior (see [PL-4](#pl-4) ) and access agreements (see [PS-6](#ps-6)).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(6)

AC-17(6) Remote Access | Protection of Mechanism Information
Family: Access Control (AC) > AC-17 Remote Access

Protect information about remote access mechanisms from unauthorized use and disclosure.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(9) > Discussion

AC-17(9) Disconnect or Disable Access - Discussion
Family: Access Control (AC) > AC-17 Remote Access

The speed of system disconnect or disablement varies based on the criticality of missions or business functions and the need to eliminate immediate or future remote access to systems.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(9)

AC-17(9) Remote Access | Disconnect or Disable Access
Family: Access Control (AC) > AC-17 Remote Access

Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(10) > Discussion

AC-17(10) Authenticate Remote Commands - Discussion
Family: Access Control (AC) > AC-17 Remote Access

Authenticating remote commands protects against unauthorized commands and the replay of authorized commands. The ability to authenticate remote commands is important for remote systems for which loss, malfunction, misdirection, or exploitation would have immediate or serious consequences, such as injury, death, property damage, loss of high value assets, failure of mission or business functions, or compromise of classified or controlled unclassified information. Authentication mechanisms for remote commands ensure that systems accept and execute commands in the order intended, execute only authorized commands, and reject unauthorized commands. Cryptographic mechanisms can be used, for example, to authenticate remote commands.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-17 > AC-17(10)

AC-17(10) Remote Access | Authenticate Remote Commands
Family: Access Control (AC) > AC-17 Remote Access

Implement [Assignment: organization-defined mechanisms] to authenticate [Assignment: organization-defined remote commands].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18

AC-18 Wireless Access
Family: Access Control (AC)

a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
b. Authorize each type of wireless access to the system prior to allowing such connections.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > Discussion

AC-18 Wireless Access - Discussion
Family: Access Control (AC)

Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(1) > Discussion

AC-18(1) Authentication and Encryption - Discussion
Family: Access Control (AC) > AC-18 Wireless Access

Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. To protect systems with wireless access points, strong authentication of users and devices along with strong encryption can reduce susceptibility to threats by adversaries involving wireless technologies.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(1)

AC-18(1) Wireless Access | Authentication and Encryption
Family: Access Control (AC) > AC-18 Wireless Access

Protect wireless access to the system using authentication of [Selection; one or more: users; devices] and encryption.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(3) > Discussion

AC-18(3) Disable Wireless Networking - Discussion
Family: Access Control (AC) > AC-18 Wireless Access

Wireless networking capabilities that are embedded within system components represent a significant potential vulnerability that can be exploited by adversaries. Disabling wireless capabilities when not needed for essential organizational missions or functions can reduce susceptibility to threats by adversaries involving wireless technologies.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(3)

AC-18(3) Wireless Access | Disable Wireless Networking
Family: Access Control (AC) > AC-18 Wireless Access

Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(4) > Discussion

AC-18(4) Restrict Configurations by Users - Discussion
Family: Access Control (AC) > AC-18 Wireless Access

Organizational authorizations to allow selected users to configure wireless networking capabilities are enforced, in part, by the access enforcement mechanisms employed within organizational systems.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(4)

AC-18(4) Wireless Access | Restrict Configurations by Users
Family: Access Control (AC) > AC-18 Wireless Access

Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(5) > Discussion

AC-18(5) Antennas and Transmission Power Levels - Discussion
Family: Access Control (AC) > AC-18 Wireless Access

Actions that may be taken to limit unauthorized use of wireless communications outside of organization-controlled boundaries include reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be captured outside of the physical perimeters of the organization, employing measures such as emissions security to control wireless emanations, and using directional or beamforming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such mitigating actions, organizations can conduct periodic wireless surveys to understand the radio frequency profile of organizational systems as well as other systems that may be operating in the area.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-18 > AC-18(5)

AC-18(5) Wireless Access | Antennas and Transmission Power Levels
Family: Access Control (AC) > AC-18 Wireless Access

Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-19

AC-19 Access Control for Mobile Devices
Family: Access Control (AC)

a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and
b. Authorize the connection of mobile devices to organizational systems.