ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-14 > Assessment Methods

CM-14 Signed Components - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing digitally signed certificates for software and firmware components

configuration management plan

system security plan

system design documentation

change control records

system component inventory

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for verifying digitally signed certificates for software and firmware component installation

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Organizational processes governing information location

mechanisms enforcing policies and methods for governing information location

automated tools supporting or implementing digitally signatures for software and firmware components

automated tools supporting or implementing verification of digital signatures for software and firmware component installation
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-14 > Assessment Objective

CM-14 Signed Components - Assessment Objective
Determine if the following are satisfied:

CM-14[01] the installation of [Assignment: organization-defined software components] is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization;
CM-14[02] the installation of [Assignment: organization-defined firmware components] is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-1 > Assessment Methods

CP-1 Policy and Procedures - Assessment Methods and Objects

Examine: Contingency planning policy and procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with contingency planning responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-1 > Assessment Objective

CP-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

CP-01a.[01] a contingency planning policy is developed and documented;
CP-01a.[02] the contingency planning policy is disseminated to [Assignment: organization-defined personnel or roles];
CP-01a.[03] contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented;
CP-01a.[04] the contingency planning procedures are disseminated to [Assignment: organization-defined personnel or roles];
CP-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy addresses purpose;
CP-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy addresses scope;
CP-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy addresses roles;
CP-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy addresses responsibilities;
CP-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy addresses management commitment;
CP-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy addresses coordination among organizational entities;
CP-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy addresses compliance;
CP-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
CP-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures;
CP-01c.01[01] the current contingency planning policy is reviewed and updated [Assignment: organization-defined frequency];
CP-01c.01[02] the current contingency planning policy is reviewed and updated following [Assignment: organization-defined events];
CP-01c.02[01] the current contingency planning procedures are reviewed and updated [Assignment: organization-defined frequency];
CP-01c.02[02] the current contingency planning procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > Assessment Methods

CP-2 Contingency Plan - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

evidence of contingency plan reviews and updates

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with incident handling responsibilities

organizational personnel with knowledge of requirements for mission and business functions

organizational personnel with information security responsibilities

Test: Organizational processes for contingency plan development, review, update, and protection

mechanisms for developing, reviewing, updating, and/or protecting the contingency plan
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > Assessment Objective

CP-2 Contingency Plan - Assessment Objective
Determine if the following are satisfied:

CP-02a.01 a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements;
CP-02a.02[01] a contingency plan for the system is developed that provides recovery objectives;
CP-02a.02[02] a contingency plan for the system is developed that provides restoration priorities;
CP-02a.02[03] a contingency plan for the system is developed that provides metrics;
CP-02a.03[01] a contingency plan for the system is developed that addresses contingency roles;
CP-02a.03[02] a contingency plan for the system is developed that addresses contingency responsibilities;
CP-02a.03[03] a contingency plan for the system is developed that addresses assigned individuals with contact information;
CP-02a.04 a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
CP-02a.05 a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented;
CP-02a.06 a contingency plan for the system is developed that addresses the sharing of contingency information;
CP-02a.07[01] a contingency plan for the system is developed that is reviewed by [Assignment: organization-defined personnel or roles];
CP-02a.07[02] a contingency plan for the system is developed that is approved by [Assignment: organization-defined personnel or roles];
CP-02b.[01] copies of the contingency plan are distributed to [Assignment: organization-defined key contingency personnel];
CP-02b.[02] copies of the contingency plan are distributed to [Assignment: organization-defined organizational elements];
CP-02c. contingency planning activities are coordinated with incident handling activities;
CP-02d. the contingency plan for the system is reviewed [Assignment: organization-defined frequency];
CP-02e.[01] the contingency plan is updated to address changes to the organization, system, or environment of operation;
CP-02e.[02] the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;
CP-02f.[01] contingency plan changes are communicated to [Assignment: organization-defined key contingency personnel];
CP-02f.[02] contingency plan changes are communicated to [Assignment: organization-defined organizational elements];
CP-02g.[01] lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing;
CP-02g.[02] lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training;
CP-02h.[01] the contingency plan is protected from unauthorized disclosure;
CP-02h.[02] the contingency plan is protected from unauthorized modification.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(1) > Assessment Methods

CP-2(1) Coordinate with Related Plans - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

business contingency plans

disaster recovery plans

continuity of operations plans

crisis communications plans

critical infrastructure plans

cyber incident response plan

insider threat implementation plans

occupant emergency plans

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with information security responsibilities

personnel with responsibility for related plans
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(1) > Assessment Objective

CP-2(1) Coordinate with Related Plans - Assessment Objective
Determine if the following are satisfied:

contingency plan development is coordinated with organizational elements responsible for related plans.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(2) > Assessment Methods

CP-2(2) Capacity Planning - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

capacity planning documents

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel responsible for capacity planning

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(2) > Assessment Objective

CP-2(2) Capacity Planning - Assessment Objective
Determine if the following are satisfied:

CP-02(02)[01] capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing;
CP-02(02)[02] capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications;
CP-02(02)[03] capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(3) > Assessment Methods

CP-2(3) Resume Mission and Business Functions - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

business impact assessment

system security plan

privacy plan

other related plans

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with knowledge of requirements for mission and business functions

Test: Organizational processes for resumption of missions and business functions
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(3) > Assessment Objective

CP-2(3) Resume Mission and Business Functions - Assessment Objective
Determine if the following are satisfied:

the resumption of [Selection: all; essential] mission and business functions are planned for within [Assignment: organization-defined time period] of contingency plan activation.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(5) > Assessment Methods

CP-2(5) Continue Mission and Business Functions - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

business impact assessment

primary processing site agreements

primary storage site agreements

alternate processing site agreements

alternate storage site agreements

contingency plan test documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with knowledge of requirements for mission and business functions

organizational personnel with information security responsibilities

Test: Organizational processes for continuing missions and business functions
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(5) > Assessment Objective

CP-2(5) Continue Mission and Business Functions - Assessment Objective
Determine if the following are satisfied:

CP-02(05)[01] the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity is planned for;
CP-02(05)[02] continuity is sustained until full system restoration at primary processing and/or storage sites.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(6) > Assessment Methods

CP-2(6) Alternate Processing and Storage Sites - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

business impact assessment

alternate processing site agreements

alternate storage site agreements

contingency plan testing documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with knowledge of requirements for mission and business functions

organizational personnel with information security responsibilities

Test: Organizational processes for transfer of essential mission and business functions to alternate processing/storage sites
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(6) > Assessment Objective

CP-2(6) Alternate Processing and Storage Sites - Assessment Objective
Determine if the following are satisfied:

CP-02(06)[01] the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for;
CP-02(06)[02] operational continuity is sustained until full system restoration at primary processing and/or storage sites.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(7) > Assessment Methods

CP-2(7) Coordinate with External Service Providers - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

contingency plans of external

service providers

service level agreements

contingency plan requirements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

external service providers

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(7) > Assessment Objective

CP-2(7) Coordinate with External Service Providers - Assessment Objective
Determine if the following are satisfied:

the contingency plan is coordinated with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(8) > Assessment Methods

CP-2(8) Identify Critical Assets - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency operations for the system

contingency plan

business impact assessment

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with knowledge of requirements for mission and business functions

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-2 > CP-2(8) > Assessment Objective

CP-2(8) Identify Critical Assets - Assessment Objective
Determine if the following are satisfied:

critical system assets supporting [Selection: all; essential] mission and business functions are identified.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-3 > Assessment Methods

CP-3 Contingency Training - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency training

contingency plan

contingency training curriculum

contingency training material

contingency training records

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning, plan implementation, and training responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for contingency training
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-3 > Assessment Objective

CP-3 Contingency Training - Assessment Objective
Determine if the following are satisfied:

CP-03a.01 contingency training is provided to system users consistent with assigned roles and responsibilities within [Assignment: organization-defined time period] of assuming a contingency role or responsibility;
CP-03a.02 contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
CP-03a.03 contingency training is provided to system users consistent with assigned roles and responsibilities [Assignment: organization-defined frequency] thereafter;
CP-03b.[01] the contingency plan training content is reviewed and updated [Assignment: organization-defined frequency];
CP-03b.[02] the contingency plan training content is reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-3 > CP-3(1) > Assessment Methods

CP-3(1) Simulated Events - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency training

contingency plan

contingency training curriculum

contingency training material

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning, plan implementation, and training responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for contingency training

mechanisms for simulating contingency events
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-3 > CP-3(1) > Assessment Objective

CP-3(1) Simulated Events - Assessment Objective
Determine if the following are satisfied:

simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-3 > CP-3(2) > Assessment Methods

CP-3(2) Mechanisms Used in Training Environments - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency training

contingency plan

contingency training curriculum

contingency training material

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning, plan implementation, and training responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for contingency training

mechanisms for providing contingency training environments
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-3 > CP-3(2) > Assessment Objective

CP-3(2) Mechanisms Used in Training Environments - Assessment Objective
Determine if the following are satisfied:

mechanisms used in operations are employed to provide a more thorough and realistic contingency training environment.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > Assessment Methods

CP-4 Contingency Plan Testing - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing contingency plan testing

contingency plan

contingency plan test documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for contingency plan testing, reviewing, or responding to contingency plan tests

organizational personnel with information security responsibilities

Test: Organizational processes for contingency plan testing

mechanisms supporting the contingency plan and/or contingency plan testing
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > Assessment Objective

CP-4 Contingency Plan Testing - Assessment Objective
Determine if the following are satisfied:

CP-04a.[01] the contingency plan for the system is tested [Assignment: organization-defined frequency];
CP-04a.[02] [Assignment: organization-defined tests] are used to determine the effectiveness of the plan;
CP-04a.[03] [Assignment: organization-defined tests] are used to determine the readiness to execute the plan;
CP-04b. the contingency plan test results are reviewed;
CP-04c. corrective actions are initiated, if needed.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(1) > Assessment Methods

CP-4(1) Coordinate with Related Plans - Assessment Methods and Objects

Examine: Contingency planning policy

incident response policy

procedures addressing contingency plan testing

contingency plan testing documentation

contingency plan

business continuity plans

disaster recovery plans

continuity of operations plans

crisis communications plans

critical infrastructure plans

cyber incident response plans

occupant emergency plans

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency plan testing responsibilities

personnel with responsibilities for related plans

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-4 > CP-4(1) > Assessment Objective

CP-4(1) Coordinate with Related Plans - Assessment Objective
Determine if the following are satisfied:

contingency plan testing is coordinated with organizational elements responsible for related plans.