ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(1)

AU-6(1) Audit Record Review, Analysis, and Reporting | Automated Process Integration
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(3) > Discussion

AU-6(3) Correlate Audit Record Repositories - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Organization-wide situational awareness includes awareness across all three levels of risk management (i.e., organizational level, mission/business process level, and information system level) and supports cross-organization awareness.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(3)

AU-6(3) Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(4) > Discussion

AU-6(4) Central Review and Analysis - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Automated mechanisms for centralized reviews and analyses include Security Information and Event Management products.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(4)

AU-6(4) Audit Record Review, Analysis, and Reporting | Central Review and Analysis
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(5) > Discussion

AU-6(5) Integrated Analysis of Audit Records - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Integrated analysis of audit records does not require vulnerability scanning, the generation of performance data, or system monitoring. Rather, integrated analysis requires that the analysis of information generated by scanning, monitoring, or other data collection activities is integrated with the analysis of audit record information. Security Information and Event Management tools can facilitate audit record aggregation or consolidation from multiple system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches for analyzing audit record information collected. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans of the system and in correlating attack detection events with scanning results. Correlation with performance data can uncover denial-of-service attacks or other types of attacks that result in the unauthorized use of resources. Correlation with system monitoring information can assist in uncovering attacks and in better relating audit information to operational situations.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(5)

AU-6(5) Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Integrate analysis of audit records with analysis of [Selection; one or more: vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources] ] to further enhance the ability to identify inappropriate or unusual activity.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(6) > Discussion

AU-6(6) Correlation with Physical Monitoring - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

The correlation of physical audit record information and the audit records from systems may assist organizations in identifying suspicious behavior or supporting evidence of such behavior. For example, the correlation of an individual's identity for logical access to certain systems with the additional physical security information that the individual was present at the facility when the logical access occurred may be useful in investigations.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(6)

AU-6(6) Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(7) > Discussion

AU-6(7) Permitted Actions - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Organizations specify permitted actions for system processes, roles, and users associated with the review, analysis, and reporting of audit records through system account management activities. Specifying permitted actions on audit record information is a way to enforce the principle of least privilege. Permitted actions are enforced by the system and include read, write, execute, append, and delete.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(7)

AU-6(7) Audit Record Review, Analysis, and Reporting | Permitted Actions
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Specify the permitted actions for each [Selection; one or more: system process; role; user] associated with the review, analysis, and reporting of audit record information.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(8) > Discussion

AU-6(8) Full Text Analysis of Privileged Commands - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Full text analysis of privileged commands requires a distinct environment for the analysis of audit record information related to privileged users without compromising such information on the system where the users have elevated privileges, including the capability to execute privileged commands. Full text analysis refers to analysis that considers the full text of privileged commands (i.e., commands and parameters) as opposed to analysis that considers only the name of the command. Full text analysis includes the use of pattern matching and heuristics.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(8)

AU-6(8) Audit Record Review, Analysis, and Reporting | Full Text Analysis of Privileged Commands
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(9) > Discussion

AU-6(9) Correlation with Information from Nontechnical Sources - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Nontechnical sources include records that document organizational policy violations related to harassment incidents and the improper use of information assets. Such information can lead to a directed analytical effort to detect potential malicious insider activity. Organizations limit access to information that is available from nontechnical sources due to its sensitive nature. Limited access minimizes the potential for inadvertent release of privacy-related information to individuals who do not have a need to know. The correlation of information from nontechnical sources with audit record information generally occurs only when individuals are suspected of being involved in an incident. Organizations obtain legal advice prior to initiating such actions.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(9)

AU-6(9) Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical Sources
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-7

AU-7 Audit Record Reduction and Report Generation
Family: Audit and Accountability (AU)

Provide and implement an audit record reduction and report generation capability that:
a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and
b. Does not alter the original content or time ordering of audit records.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-7 > Discussion

AU-7 Audit Record Reduction and Report Generation - Discussion
Family: Audit and Accountability (AU)

Audit record reduction is a process that manipulates collected audit log information and organizes it into a summary format that is more meaningful to analysts. Audit record reduction and report generation capabilities do not always emanate from the same system or from the same organizational entities that conduct audit logging activities. The audit record reduction capability includes modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the system can generate customizable reports. Time ordering of audit records can be an issue if the granularity of the timestamp in the record is insufficient.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-7 > AU-7(1) > Discussion

AU-7(1) Automatic Processing - Discussion
Family: Audit and Accountability (AU) > AU-7 Audit Record Reduction and Report Generation

Events of interest can be identified by the content of audit records, including system resources involved, information objects accessed, identities of individuals, event types, event locations, event dates and times, Internet Protocol addresses involved, or event success or failure. Organizations may define event criteria to any degree of granularity required, such as locations selectable by a general networking location or by specific system component.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-7 > AU-7(1)

AU-7(1) Audit Record Reduction and Report Generation | Automatic Processing
Family: Audit and Accountability (AU) > AU-7 Audit Record Reduction and Report Generation

Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-8

AU-8 Time Stamps
Family: Audit and Accountability (AU)

a. Use internal system clocks to generate time stamps for audit records; and
b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-8 > Discussion

AU-8 Time Stamps - Discussion
Family: Audit and Accountability (AU)

Time stamps generated by the system include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. Granularity of time measurements refers to the degree of synchronization between system clocks and reference clocks (e.g., clocks synchronizing within hundreds of milliseconds or tens of milliseconds). Organizations may define different time granularities for different system components. Time service can be critical to other security capabilities such as access control and identification and authentication, depending on the nature of the mechanisms used to support those capabilities.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9

AU-9 Protection of Audit Information
Family: Audit and Accountability (AU)

a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
b. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > Discussion

AU-9 Protection of Audit Information - Discussion
Family: Audit and Accountability (AU)

Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(1) > Discussion

AU-9(1) Hardware Write-once Media - Discussion
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Writing audit trails to hardware-enforced, write-once media applies to the initial generation of audit trails (i.e., the collection of audit records that represents the information to be used for detection, analysis, and reporting purposes) and to the backup of those audit trails. Writing audit trails to hardware-enforced, write-once media does not apply to the initial generation of audit records prior to being written to an audit trail. Write-once, read-many (WORM) media includes Compact Disc-Recordable (CD-R), Blu-Ray Disc Recordable (BD-R), and Digital Versatile Disc-Recordable (DVD-R). In contrast, the use of switchable write-protection media, such as tape cartridges, Universal Serial Bus (USB) drives, Compact Disc Re-Writeable (CD-RW), and Digital Versatile Disc-Read Write (DVD-RW) results in write-protected but not write-once media.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(1)

AU-9(1) Protection of Audit Information | Hardware Write-once Media
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Write audit trails to hardware-enforced, write-once media.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(2) > Discussion

AU-9(2) Store on Separate Physical Systems or Components - Discussion
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Storing audit records in a repository separate from the audited system or system component helps to ensure that a compromise of the system being audited does not also result in a compromise of the audit records. Storing audit records on separate physical systems or components also preserves the confidentiality and integrity of audit records and facilitates the management of audit records as an organization-wide activity. Storing audit records on separate systems or components applies to initial generation as well as backup or long-term storage of audit records.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(2)

AU-9(2) Protection of Audit Information | Store on Separate Physical Systems or Components
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(3) > Discussion

AU-9(3) Cryptographic Protection - Discussion
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Cryptographic mechanisms used for protecting the integrity of audit information include signed hash functions using asymmetric cryptography. This enables the distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(3)

AU-9(3) Protection of Audit Information | Cryptographic Protection
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(4) > Discussion

AU-9(4) Access by Subset of Privileged Users - Discussion
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Individuals or roles with privileged access to a system and who are also the subject of an audit by that system may affect the reliability of the audit information by inhibiting audit activities or modifying audit records. Requiring privileged access to be further defined between audit-related privileges and other privileges limits the number of users or roles with audit-related privileges.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(4)

AU-9(4) Protection of Audit Information | Access by Subset of Privileged Users
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(5) > Discussion

AU-9(5) Dual Authorization - Discussion
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Organizations may choose different selection options for different types of audit information. Dual authorization mechanisms (also known as two-person control) require the approval of two authorized individuals to execute audit functions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(5)

AU-9(5) Protection of Audit Information | Dual Authorization
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Enforce dual authorization for [Selection; one or more: movement; deletion] of [Assignment: organization-defined audit information].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(6) > Discussion

AU-9(6) Read-only Access - Discussion
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Restricting privileged user or role authorizations to read-only helps to limit the potential damage to organizations that could be initiated by such users or roles, such as deleting audit records to cover up malicious activity.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(6)

AU-9(6) Protection of Audit Information | Read-only Access
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Authorize read-only access to audit information to [Assignment: organization-defined subset of privileged users or roles].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(7) > Discussion

AU-9(7) Store on Component with Different Operating System - Discussion
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Storing auditing information on a system component running a different operating system reduces the risk of a vulnerability specific to the system, resulting in a compromise of the audit records.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-9 > AU-9(7)

AU-9(7) Protection of Audit Information | Store on Component with Different Operating System
Family: Audit and Accountability (AU) > AU-9 Protection of Audit Information

Store audit information on a component running a different operating system than the system or component being audited.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10

AU-10 Non-repudiation
Family: Audit and Accountability (AU)

Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > Discussion

AU-10 Non-repudiation - Discussion
Family: Audit and Accountability (AU)

Types of individual actions covered by non-repudiation include creating information, sending and receiving messages, and approving information. Non-repudiation protects against claims by authors of not having authored certain documents, senders of not having transmitted messages, receivers of not having received messages, and signatories of not having signed documents. Non-repudiation services can be used to determine if information originated from an individual or if an individual took specific actions (e.g., sending an email, signing a contract, approving a procurement request, or receiving specific information). Organizations obtain non-repudiation services by employing various techniques or mechanisms, including digital signatures and digital message receipts.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(1) > Discussion

AU-10(1) Association of Identities - Discussion
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

Binding identities to the information supports audit requirements that provide organizational personnel with the means to identify who produced specific information in the event of an information transfer. Organizations determine and approve the strength of attribute binding between the information producer and the information based on the security category of the information and other relevant risk factors.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(1)

AU-10(1) Non-repudiation | Association of Identities
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

(a) Bind the identity of the information producer with the information to [Assignment: organization-defined strength of binding] ; and
(b) Provide the means for authorized individuals to determine the identity of the producer of the information.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(2) > Discussion

AU-10(2) Validate Binding of Information Producer Identity - Discussion
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

Validating the binding of the information producer identity to the information prevents the modification of information between production and review. The validation of bindings can be achieved by, for example, using cryptographic checksums. Organizations determine if validations are in response to user requests or generated automatically.