ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(3) > Discussion

CM-8(3) Automated Unauthorized Component Detection - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

Automated unauthorized component detection is applied in addition to the monitoring for unauthorized remote connections and mobile devices. Monitoring for unauthorized system components may be accomplished on an ongoing basis or by the periodic scanning of systems for that purpose. Automated mechanisms may also be used to prevent the connection of unauthorized components (see [CM-7(9)](#cm-7.9) ). Automated mechanisms can be implemented in systems or in separate system components. When acquiring and implementing automated mechanisms, organizations consider whether such mechanisms depend on the ability of the system component to support an agent or supplicant in order to be detected since some types of components do not have or cannot support agents (e.g., IoT devices, sensors). Isolation can be achieved , for example, by placing unauthorized system components in separate domains or subnets or quarantining such components. This type of component isolation is commonly referred to as "sandboxing."
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(3)

CM-8(3) System Component Inventory | Automated Unauthorized Component Detection
Family: Configuration Management (CM) > CM-8 System Component Inventory

(a) Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined organization-defined automated mechanisms] [Assignment: organization-defined frequency] ; and
(b) Take the following actions when unauthorized components are detected: [Selection; one or more: disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: organization-defined personnel or roles] ].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(4) > Discussion

CM-8(4) Accountability Information - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

Identifying individuals who are responsible and accountable for administering system components ensures that the assigned components are properly administered and that organizations can contact those individuals if some action is required (e.g., when the component is determined to be the source of a breach, needs to be recalled or replaced, or needs to be relocated).
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(4)

CM-8(4) System Component Inventory | Accountability Information
Family: Configuration Management (CM) > CM-8 System Component Inventory

Include in the system component inventory information, a means for identifying by [Selection; one or more: name; position; role] , individuals responsible and accountable for administering those components.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(6) > Discussion

CM-8(6) Assessed Configurations and Approved Deviations - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

Assessed configurations and approved deviations focus on configuration settings established by organizations for system components, the specific components that have been assessed to determine compliance with the required configuration settings, and any approved deviations from established configuration settings.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(6)

CM-8(6) System Component Inventory | Assessed Configurations and Approved Deviations
Family: Configuration Management (CM) > CM-8 System Component Inventory

Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(7) > Discussion

CM-8(7) Centralized Repository - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

Organizations may implement centralized system component inventories that include components from all organizational systems. Centralized repositories of component inventories provide opportunities for efficiencies in accounting for organizational hardware, software, and firmware assets. Such repositories may also help organizations rapidly identify the location and responsible individuals of components that have been compromised, breached, or are otherwise in need of mitigation actions. Organizations ensure that the resulting centralized inventories include system-specific information required for proper component accountability.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(7)

CM-8(7) System Component Inventory | Centralized Repository
Family: Configuration Management (CM) > CM-8 System Component Inventory

Provide a centralized repository for the inventory of system components.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(8) > Discussion

CM-8(8) Automated Location Tracking - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

The use of automated mechanisms to track the location of system components can increase the accuracy of component inventories. Such capability may help organizations rapidly identify the location and responsible individuals of system components that have been compromised, breached, or are otherwise in need of mitigation actions. The use of tracking mechanisms can be coordinated with senior agency officials for privacy if there are implications that affect individual privacy.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(8)

CM-8(8) System Component Inventory | Automated Location Tracking
Family: Configuration Management (CM) > CM-8 System Component Inventory

Support the tracking of system components by geographic location using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(9) > Discussion

CM-8(9) Assignment of Components to Systems - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

System components that are not assigned to a system may be unmanaged, lack the required protection, and become an organizational vulnerability.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(9)

CM-8(9) System Component Inventory | Assignment of Components to Systems
Family: Configuration Management (CM) > CM-8 System Component Inventory

(a) Assign system components to a system; and
(b) Receive an acknowledgement from [Assignment: organization-defined personnel or roles] of this assignment.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-9

CM-9 Configuration Management Plan
Family: Configuration Management (CM)

Develop, document, and implement a configuration management plan for the system that:
a. Addresses roles, responsibilities, and configuration management processes and procedures;
b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;
c. Defines the configuration items for the system and places the configuration items under configuration management;
d. Is reviewed and approved by [Assignment: organization-defined personnel or roles] ; and
e. Protects the configuration management plan from unauthorized disclosure and modification.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-9 > Discussion

CM-9 Configuration Management Plan - Discussion
Family: Configuration Management (CM)

Configuration management activities occur throughout the system development life cycle. As such, there are developmental configuration management activities (e.g., the control of code and software libraries) and operational configuration management activities (e.g., control of installed components and how the components are configured). Configuration management plans satisfy the requirements in configuration management policies while being tailored to individual systems. Configuration management plans define processes and procedures for how configuration management is used to support system development life cycle activities.

Configuration management plans are generated during the development and acquisition stage of the system development life cycle. The plans describe how to advance changes through change management processes; update configuration settings and baselines; maintain component inventories; control development, test, and operational environments; and develop, release, and update key documents.

Organizations can employ templates to help ensure the consistent and timely development and implementation of configuration management plans. Templates can represent a configuration management plan for the organization with subsets of the plan implemented on a system by system basis. Configuration management approval processes include the designation of key stakeholders responsible for reviewing and approving proposed changes to systems, and personnel who conduct security and privacy impact analyses prior to the implementation of changes to the systems. Configuration items are the system components, such as the hardware, software, firmware, and documentation to be configuration-managed. As systems continue through the system development life cycle, new configuration items may be identified, and some existing configuration items may no longer need to be under configuration control.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-9 > CM-9(1) > Discussion

CM-9(1) Assignment of Responsibility - Discussion
Family: Configuration Management (CM) > CM-9 Configuration Management Plan

In the absence of dedicated configuration management teams assigned within organizations, system developers may be tasked with developing configuration management processes using personnel who are not directly involved in system development or system integration. This separation of duties ensures that organizations establish and maintain a sufficient degree of independence between the system development and integration processes and configuration management processes to facilitate quality control and more effective oversight.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-9 > CM-9(1)

CM-9(1) Configuration Management Plan | Assignment of Responsibility
Family: Configuration Management (CM) > CM-9 Configuration Management Plan

Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-10

CM-10 Software Usage Restrictions
Family: Configuration Management (CM)

a. Use software and associated documentation in accordance with contract agreements and copyright laws;
b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and
c. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-10 > Discussion

CM-10 Software Usage Restrictions - Discussion
Family: Configuration Management (CM)

Software license tracking can be accomplished by manual or automated methods, depending on organizational needs. Examples of contract agreements include software license agreements and non-disclosure agreements.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-10 > CM-10(1) > Discussion

CM-10(1) Open-source Software - Discussion
Family: Configuration Management (CM) > CM-10 Software Usage Restrictions

Open-source software refers to software that is available in source code form. Certain software rights normally reserved for copyright holders are routinely provided under software license agreements that permit individuals to study, change, and improve the software. From a security perspective, the major advantage of open-source software is that it provides organizations with the ability to examine the source code. In some cases, there is an online community associated with the software that inspects, tests, updates, and reports on issues found in software on an ongoing basis. However, remediating vulnerabilities in open-source software may be problematic. There may also be licensing issues associated with open-source software, including the constraints on derivative use of such software. Open-source software that is available only in binary form may increase the level of risk in using such software.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-10 > CM-10(1)

CM-10(1) Software Usage Restrictions | Open-source Software
Family: Configuration Management (CM) > CM-10 Software Usage Restrictions

Establish the following restrictions on the use of open-source software: [Assignment: organization-defined restrictions].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-11

CM-11 User-installed Software
Family: Configuration Management (CM)

a. Establish [Assignment: organization-defined policies] governing the installation of software by users;
b. Enforce software installation policies through the following methods: [Assignment: organization-defined methods] ; and
c. Monitor policy compliance [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-11 > Discussion

CM-11 User-installed Software - Discussion
Family: Configuration Management (CM)

If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved "app stores." Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-11 > CM-11(2) > Discussion

CM-11(2) Software Installation with Privileged Status - Discussion
Family: Configuration Management (CM) > CM-11 User-installed Software

Privileged status can be obtained, for example, by serving in the role of system administrator.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-11 > CM-11(2)

CM-11(2) User-installed Software | Software Installation with Privileged Status
Family: Configuration Management (CM) > CM-11 User-installed Software

Allow user installation of software only with explicit privileged status.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-11 > CM-11(3) > Discussion

CM-11(3) Automated Enforcement and Monitoring - Discussion
Family: Configuration Management (CM) > CM-11 User-installed Software

Organizations enforce and monitor compliance with software installation policies using automated mechanisms to more quickly detect and respond to unauthorized software installation which can be an indicator of an internal or external hostile attack.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-11 > CM-11(3)

CM-11(3) User-installed Software | Automated Enforcement and Monitoring
Family: Configuration Management (CM) > CM-11 User-installed Software

Enforce and monitor compliance with software installation policies using [Assignment: organization-defined organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-12

CM-12 Information Location
Family: Configuration Management (CM)

a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored;
b. Identify and document the users who have access to the system and system components where the information is processed and stored; and
c. Document changes to the location (i.e., system or system components) where the information is processed and stored.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-12 > Discussion

CM-12 Information Location - Discussion
Family: Configuration Management (CM)

Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see [FIPS 199](#628d22a1-6a11-4784-bc59-5cd9497b5445) ). The location of the information and system components is also a factor in the architecture and design of the system (see [SA-4](#sa-4), [SA-8](#sa-8), [SA-17](#sa-17)).
Security and Privacy Controls for Information Systems and Organizations
CM > CM-12 > CM-12(1) > Discussion

CM-12(1) Automated Tools to Support Information Location - Discussion
Family: Configuration Management (CM) > CM-12 Information Location

The use of automated tools helps to increase the effectiveness and efficiency of the information location capability implemented within the system. Automation also helps organizations manage the data produced during information location activities and share such information across the organization. The output of automated information location tools can be used to guide and inform system architecture and design decisions.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-12 > CM-12(1)

CM-12(1) Information Location | Automated Tools to Support Information Location
Family: Configuration Management (CM) > CM-12 Information Location

Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational information and individual privacy.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-13

CM-13 Data Action Mapping
Family: Configuration Management (CM)

Develop and document a map of system data actions.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-13 > Discussion

CM-13 Data Action Mapping - Discussion
Family: Configuration Management (CM)

Data actions are system operations that process personally identifiable information. The processing of such information encompasses the full information life cycle, which includes collection, generation, transformation, use, disclosure, retention, and disposal. A map of system data actions includes discrete data actions, elements of personally identifiable information being processed in the data actions, system components involved in the data actions, and the owners or operators of the system components. Understanding what personally identifiable information is being processed (e.g., the sensitivity of the personally identifiable information), how personally identifiable information is being processed (e.g., if the data action is visible to the individual or is processed in another part of the system), and by whom (e.g., individuals may have different privacy perceptions based on the entity that is processing the personally identifiable information) provides a number of contextual factors that are important to assessing the degree of privacy risk created by the system. Data maps can be illustrated in different ways, and the level of detail may vary based on the mission and business needs of the organization. The data map may be an overlay of any system design artifact that the organization is using. The development of this map may necessitate coordination between the privacy and security programs regarding the covered data actions and the components that are identified as part of the system.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-14

CM-14 Signed Components
Family: Configuration Management (CM)

Prevent the installation of [Assignment: organization-defined organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-14 > Discussion

CM-14 Signed Components - Discussion
Family: Configuration Management (CM)

Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-1

CP-1 Policy and Procedures
Family: Contingency Planning (CP)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and
c. Review and update the current contingency planning:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].