ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-3 > CA-3(6) > Assessment Methods

CA-3(6) Transfer Authorizations - Assessment Methods and Objects

Examine: Access control policy

procedures addressing system connections

system and communications protection policy

system interconnection agreements

information exchange security agreements

memoranda of understanding or agreements

service level agreements

non-disclosure agreements

system design documentation

system configuration settings and associated documentation

control assessment report

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing connections to external systems

network administrators

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing restrictions on external system connections
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-3 > CA-3(6) > Assessment Objective

CA-3(6) Transfer Authorizations - Assessment Objective
Determine if the following are satisfied:

individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-3 > CA-3(7) > Assessment Methods

CA-3(7) Transitive Information Exchanges - Assessment Methods and Objects

Examine: Access control policy

procedures addressing system connections

system and communications protection policy

system interconnection agreements

information exchange security agreements

memoranda of understanding or agreements

service level agreements

non-disclosure agreements

system design documentation

system configuration settings and associated documentation

control assessment report

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing connections to external systems

network administrators

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing restrictions on external system connections
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-3 > CA-3(7) > Assessment Objective

CA-3(7) Transitive Information Exchanges - Assessment Objective
Determine if the following are satisfied:

CA-03(07)(a) transitive (downstream) information exchanges with other systems through the systems identified in CA-03a are identified;
CA-03(07)(b) measures are taken to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-5 > Assessment Methods

CA-5 Plan of Action and Milestones - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing plan of action and milestones

control assessment plan

control assessment report

control assessment evidence

plan of action and milestones

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with plan of action and milestones development and implementation responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms for developing, implementing, and maintaining plan of action and milestones
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-5 > Assessment Objective

CA-5 Plan of Action and Milestones - Assessment Objective
Determine if the following are satisfied:

CA-05a. a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;
CA-05b. existing plan of action and milestones are updated [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-5 > CA-5(1) > Assessment Methods

CA-5(1) Automation Support for Accuracy and Currency - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing plan of action and milestones

system design documentation

system configuration settings and associated documentation

system audit records

plan of action and milestones

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with plan of action and milestones development and implementation responsibilities

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms for developing, implementing, and maintaining a plan of action and milestones
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-5 > CA-5(1) > Assessment Objective

CA-5(1) Automation Support for Accuracy and Currency - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined automated mechanisms] are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-6 > Assessment Methods

CA-6 Authorization - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing authorization

system security plan, privacy plan, assessment report, plan of action and milestones

authorization statement

other relevant documents or records

Interview: Organizational personnel with authorization responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms that facilitate authorizations and updates
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-6 > Assessment Objective

CA-6 Authorization - Assessment Objective
Determine if the following are satisfied:

CA-06a. a senior official is assigned as the authorizing official for the system;
CA-06b. a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;
CA-06c.01 before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;
CA-06c.02 before commencing operations, the authorizing official for the system authorizes the system to operate;
CA-06d. the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
CA-06e. the authorizations are updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-6 > CA-6(1) > Assessment Methods

CA-6(1) Joint Authorization - Intra-organization - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing authorization

system security plan

privacy plan

assessment report

plan of action and milestones

authorization statement

other relevant documents or records

Interview: Organizational personnel with authorization responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms that facilitate authorizations and updates
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-6 > CA-6(1) > Assessment Objective

CA-6(1) Joint Authorization - Intra-organization - Assessment Objective
Determine if the following are satisfied:

CA-06(01)[01] a joint authorization process is employed for the system;
CA-06(01)[02] the joint authorization process employed for the system includes multiple authorizing officials from the same organization conducting the authorization.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-6 > CA-6(2) > Assessment Methods

CA-6(2) Joint Authorization - Inter-organization - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing authorization

system security plan

privacy plan

assessment report

plan of action and milestones

authorization statement

other relevant documents or records

Interview: Organizational personnel with authorization responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms that facilitate authorizations and updates
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-6 > CA-6(2) > Assessment Objective

CA-6(2) Joint Authorization - Inter-organization - Assessment Objective
Determine if the following are satisfied:

CA-06(02)[01] a joint authorization process is employed for the system;
CA-06(02)[02] the joint authorization process employed for the system includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > Assessment Methods

CA-7 Continuous Monitoring - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

organizational continuous monitoring strategy

system-level continuous monitoring strategy

procedures addressing continuous monitoring of system controls

procedures addressing configuration management

control assessment report

plan of action and milestones

system monitoring records

configuration management records

impact analyses

status reports

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with continuous monitoring responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms implementing continuous monitoring

mechanisms supporting response actions to address assessment and monitoring results

mechanisms supporting security and privacy status reporting
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > Assessment Objective

CA-7 Continuous Monitoring - Assessment Objective
Determine if the following are satisfied:

CA-07[01] a system-level continuous monitoring strategy is developed;
CA-07[02] system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy;
CA-07a. system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];
CA-07b.[01] system-level continuous monitoring includes established [Assignment: organization-defined frequencies] for monitoring;
CA-07b.[02] system-level continuous monitoring includes established [Assignment: organization-defined frequencies] for assessment of control effectiveness;
CA-07c. system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy;
CA-07d. system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
CA-07e. system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring;
CA-07f. system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information;
CA-07g.[01] system-level continuous monitoring includes reporting the security status of the system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency];
CA-07g.[02] system-level continuous monitoring includes reporting the privacy status of the system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(1) > Assessment Methods

CA-7(1) Independent Assessment - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

organizational continuous monitoring strategy

system-level continuous monitoring strategy

procedures addressing continuous monitoring of system controls

control assessment report

plan of action and milestones

system monitoring records

impact analyses

status reports

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with continuous monitoring responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(1) > Assessment Objective

CA-7(1) Independent Assessment - Assessment Objective
Determine if the following are satisfied:

independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(3) > Assessment Methods

CA-7(3) Trend Analyses - Assessment Methods and Objects

Examine: Organizational continuous monitoring strategy

system-level continuous monitoring strategy

assessment, authorization, and monitoring policy

procedures addressing continuous monitoring of system controls

privacy controls

assessment report

plan of action and milestones

system monitoring records

impact analyses

status reports

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with continuous monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting trend analyses
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(3) > Assessment Objective

CA-7(3) Trend Analyses - Assessment Objective
Determine if the following are satisfied:

CA-07(03)[01] trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data;
CA-07(03)[02] trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data;
CA-07(03)[03] trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(4) > Assessment Methods

CA-7(4) Risk Monitoring - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

organizational continuous monitoring strategy

system-level continuous monitoring strategy

procedures addressing continuous monitoring of system controls

assessment report

plan of action and milestones

system monitoring records

impact analyses

status reports

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with continuous monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting risk monitoring
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(4) > Assessment Objective

CA-7(4) Risk Monitoring - Assessment Objective
Determine if the following are satisfied:

risk monitoring is an integral part of the continuous monitoring strategy;
CA-07(04)(a) effectiveness monitoring is included in risk monitoring;
CA-07(04)(b) compliance monitoring is included in risk monitoring;
CA-07(04)(c) change monitoring is included in risk monitoring.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(5) > Assessment Methods

CA-7(5) Consistency Analysis - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

organizational continuous monitoring strategy

system-level continuous monitoring strategy

procedures addressing continuous monitoring of system security controls

assessment report

plan of action and milestones

system monitoring records

security impact analyses

status reports

system security plan

other relevant documents or records

Interview: Organizational personnel with continuous monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting consistency analyses
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(5) > Assessment Objective

CA-7(5) Consistency Analysis - Assessment Objective
Determine if the following are satisfied:

CA-07(05)[01] [Assignment: organization-defined actions] are employed to validate that policies are established;
CA-07(05)[02] [Assignment: organization-defined actions] are employed to validate that implemented controls are operating in a consistent manner.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(6) > Assessment Methods

CA-7(6) Automation Support for Monitoring - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

organizational continuous monitoring strategy

system-level continuous monitoring strategy

procedures addressing continuous monitoring of system controls

assessment report

plan of action and milestones

system monitoring records

impact analyses

status reports

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with continuous monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting automated monitoring
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-7 > CA-7(6) > Assessment Objective

CA-7(6) Automation Support for Monitoring - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined automated mechanisms] are used to ensure the accuracy, currency, and availability of monitoring results for the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > Assessment Methods

CA-8 Penetration Testing - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing penetration testing

assessment plan

penetration test report

assessment report

assessment evidence

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with control assessment responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms supporting penetration testing
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > Assessment Objective

CA-8 Penetration Testing - Assessment Objective
Determine if the following are satisfied:

penetration testing is conducted [Assignment: organization-defined frequency] on [Assignment: organization-defined system(s) or system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > CA-8(1) > Assessment Methods

CA-8(1) Independent Penetration Testing Agent or Team - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing penetration testing

assessment plan

penetration test report

assessment report

security assessment evidence

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with assessment responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > CA-8(1) > Assessment Objective

CA-8(1) Independent Penetration Testing Agent or Team - Assessment Objective
Determine if the following are satisfied:

an independent penetration testing agent or team is employed to perform penetration testing on the system or system components.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > CA-8(2) > Assessment Methods

CA-8(2) Red Team Exercises - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing penetration testing

procedures addressing red team exercises

assessment plan

results of red team exercises

penetration test report

assessment report

rules of engagement

assessment evidence

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with assessment responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms supporting the employment of red team exercises
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > CA-8(2) > Assessment Objective

CA-8(2) Red Team Exercises - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined red team exercises] are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > CA-8(3) > Assessment Methods

CA-8(3) Facility Penetration Testing - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing penetration testing

procedures addressing red team exercises

assessment plan

results of red team exercises

penetration test report

assessment report

rules of engagement

assessment evidence

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with assessment responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Automated mechanisms supporting the employment of red team exercises
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-8 > CA-8(3) > Assessment Objective

CA-8(3) Facility Penetration Testing - Assessment Objective
Determine if the following are satisfied:

the penetration testing process includes [Assignment: organization-defined frequency] [Selection; one or more: announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to facility.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-9 > Assessment Methods

CA-9 Internal System Connections - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

access control policy

procedures addressing system connections

system and communications protection policy

system design documentation

system configuration settings and associated documentation

list of components or classes of components authorized as internal system connections

assessment report

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting internal system connections