ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15 > SC-15(1) > Discussion

SC-15(1) Physical or Logical Disconnect - Discussion
Family: System and Communications Protection (SC) > SC-15 Collaborative Computing Devices and Applications

Failing to disconnect from collaborative computing devices can result in subsequent compromises of organizational information. Providing easy methods to disconnect from such devices after a collaborative computing session ensures that participants carry out the disconnect activity without having to go through complex and tedious procedures. Disconnect from collaborative computing devices can be manual or automatic.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15 > SC-15(1)

SC-15(1) Collaborative Computing Devices and Applications | Physical or Logical Disconnect
Family: System and Communications Protection (SC) > SC-15 Collaborative Computing Devices and Applications

Provide [Selection; one or more: physical; logical] disconnect of collaborative computing devices in a manner that supports ease of use.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15 > SC-15(3) > Discussion

SC-15(3) Disabling and Removal in Secure Work Areas - Discussion
Family: System and Communications Protection (SC) > SC-15 Collaborative Computing Devices and Applications

Failing to disable or remove collaborative computing devices and applications from systems or system components can result in compromises of information, including eavesdropping on conversations. A Sensitive Compartmented Information Facility (SCIF) is an example of a secure work area.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15 > SC-15(3)

SC-15(3) Collaborative Computing Devices and Applications | Disabling and Removal in Secure Work Areas
Family: System and Communications Protection (SC) > SC-15 Collaborative Computing Devices and Applications

Disable or remove collaborative computing devices and applications from [Assignment: organization-defined systems or system components] in [Assignment: organization-defined secure work areas].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15 > SC-15(4) > Discussion

SC-15(4) Explicitly Indicate Current Participants - Discussion
Family: System and Communications Protection (SC) > SC-15 Collaborative Computing Devices and Applications

Explicitly indicating current participants prevents unauthorized individuals from participating in collaborative computing sessions without the explicit knowledge of other participants.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15 > SC-15(4)

SC-15(4) Collaborative Computing Devices and Applications | Explicitly Indicate Current Participants
Family: System and Communications Protection (SC) > SC-15 Collaborative Computing Devices and Applications

Provide an explicit indication of current participants in [Assignment: organization-defined online meetings and teleconferences].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16

SC-16 Transmission of Security and Privacy Attributes
Family: System and Communications Protection (SC)

Associate [Assignment: organization-defined organization-defined security and privacy attributes] with information exchanged between systems and between system components.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16 > Discussion

SC-16 Transmission of Security and Privacy Attributes - Discussion
Family: System and Communications Protection (SC)

Security and privacy attributes can be explicitly or implicitly associated with the information contained in organizational systems or system components. Attributes are abstractions that represent the basic properties or characteristics of an entity with respect to protecting information or the management of personally identifiable information. Attributes are typically associated with internal data structures, including records, buffers, and files within the system. Security and privacy attributes are used to implement access control and information flow control policies; reflect special dissemination, management, or distribution instructions, including permitted uses of personally identifiable information; or support other aspects of the information security and privacy policies. Privacy attributes may be used independently or in conjunction with security attributes.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16 > SC-16(1) > Discussion

SC-16(1) Integrity Verification - Discussion
Family: System and Communications Protection (SC) > SC-16 Transmission of Security and Privacy Attributes

Part of verifying the integrity of transmitted information is ensuring that security and privacy attributes that are associated with such information have not been modified in an unauthorized manner. Unauthorized modification of security or privacy attributes can result in a loss of integrity for transmitted information.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16 > SC-16(1)

SC-16(1) Transmission of Security and Privacy Attributes | Integrity Verification
Family: System and Communications Protection (SC) > SC-16 Transmission of Security and Privacy Attributes

Verify the integrity of transmitted security and privacy attributes.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16 > SC-16(2) > Discussion

SC-16(2) Anti-spoofing Mechanisms - Discussion
Family: System and Communications Protection (SC) > SC-16 Transmission of Security and Privacy Attributes

Some attack vectors operate by altering the security attributes of an information system to intentionally and maliciously implement an insufficient level of security within the system. The alteration of attributes leads organizations to believe that a greater number of security functions are in place and operational than have actually been implemented.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16 > SC-16(2)

SC-16(2) Transmission of Security and Privacy Attributes | Anti-spoofing Mechanisms
Family: System and Communications Protection (SC) > SC-16 Transmission of Security and Privacy Attributes

Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16 > SC-16(3) > Discussion

SC-16(3) Cryptographic Binding - Discussion
Family: System and Communications Protection (SC) > SC-16 Transmission of Security and Privacy Attributes

Cryptographic mechanisms and techniques can provide strong security and privacy attribute binding to transmitted information to help ensure the integrity of such information.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-16 > SC-16(3)

SC-16(3) Transmission of Security and Privacy Attributes | Cryptographic Binding
Family: System and Communications Protection (SC) > SC-16 Transmission of Security and Privacy Attributes

Implement [Assignment: organization-defined mechanisms or techniques] to bind security and privacy attributes to transmitted information.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-17

SC-17 Public Key Infrastructure Certificates
Family: System and Communications Protection (SC)

a. Issue public key certificates under an [Assignment: organization-defined certificate policy] or obtain public key certificates from an approved service provider; and
b. Include only approved trust anchors in trust stores or certificate stores managed by the organization.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-17 > Discussion

SC-17 Public Key Infrastructure Certificates - Discussion
Family: System and Communications Protection (SC)

Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18

SC-18 Mobile Code
Family: System and Communications Protection (SC)

a. Define acceptable and unacceptable mobile code and mobile code technologies; and
b. Authorize, monitor, and control the use of mobile code within the system.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > Discussion

SC-18 Mobile Code - Discussion
Family: System and Communications Protection (SC)

Mobile code includes any program, application, or content that can be transmitted across a network (e.g., embedded in an email, document, or website) and executed on a remote system. Decisions regarding the use of mobile code within organizational systems are based on the potential for the code to cause damage to the systems if used maliciously. Mobile code technologies include Java applets, JavaScript, HTML5, WebGL, and VBScript. Usage restrictions and implementation guidelines apply to both the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations and devices, including notebook computers and smart phones. Mobile code policy and procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(1) > Discussion

SC-18(1) Identify Unacceptable Code and Take Corrective Actions - Discussion
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Corrective actions when unacceptable mobile code is detected include blocking, quarantine, or alerting administrators. Blocking includes preventing the transmission of word processing files with embedded macros when such macros have been determined to be unacceptable mobile code.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(1)

SC-18(1) Mobile Code | Identify Unacceptable Code and Take Corrective Actions
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Identify [Assignment: organization-defined unacceptable mobile code] and take [Assignment: organization-defined corrective actions].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(2)

SC-18(2) Mobile Code | Acquisition, Development, and Use
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Verify that the acquisition, development, and use of mobile code to be deployed in the system meets [Assignment: organization-defined mobile code requirements].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(3)

SC-18(3) Mobile Code | Prevent Downloading and Execution
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Prevent the download and execution of [Assignment: organization-defined unacceptable mobile code].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(4) > Discussion

SC-18(4) Prevent Automatic Execution - Discussion
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Actions enforced before executing mobile code include prompting users prior to opening email attachments or clicking on web links. Preventing the automatic execution of mobile code includes disabling auto-execute features on system components that employ portable storage devices, such as compact discs, digital versatile discs, and universal serial bus devices.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(4)

SC-18(4) Mobile Code | Prevent Automatic Execution
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Prevent the automatic execution of mobile code in [Assignment: organization-defined software applications] and enforce [Assignment: organization-defined actions] prior to executing the code.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(5) > Discussion

SC-18(5) Allow Execution Only in Confined Environments - Discussion
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Permitting the execution of mobile code only in confined virtual machine environments helps prevent the introduction of malicious code into other systems and system components.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-18 > SC-18(5)

SC-18(5) Mobile Code | Allow Execution Only in Confined Environments
Family: System and Communications Protection (SC) > SC-18 Mobile Code

Allow execution of permitted mobile code only in confined virtual machine environments.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-20

SC-20 Secure Name/Address Resolution Service (Authoritative Source)
Family: System and Communications Protection (SC)

a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and
b. Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-20 > Discussion

SC-20 Secure Name/Address Resolution Service (Authoritative Source) - Discussion
Family: System and Communications Protection (SC)

Providing authoritative source information enables external clients, including remote Internet clients, to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service. Systems that provide name and address resolution services include domain name system (DNS) servers. Additional artifacts include DNS Security Extensions (DNSSEC) digital signatures and cryptographic keys. Authoritative data includes DNS resource records. The means for indicating the security status of child zones include the use of delegation signer resource records in the DNS. Systems that use technologies other than the DNS to map between host and service names and network addresses provide other means to assure the authenticity and integrity of response data.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-20 > SC-20(2)

SC-20(2) Secure Name/Address Resolution Service (Authoritative Source) | Data Origin and Integrity
Family: System and Communications Protection (SC) > SC-20 Secure Name/Address Resolution Service (Authoritative Source)

Provide data origin and integrity protection artifacts for internal name/address resolution queries.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-21

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
Family: System and Communications Protection (SC)

Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-21 > Discussion

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) - Discussion
Family: System and Communications Protection (SC)

Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Systems that provide name and address resolution services for local clients include recursive resolving or caching domain name system (DNS) servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations. Systems that use technologies other than the DNS to map between host and service names and network addresses provide some other means to enable clients to verify the authenticity and integrity of response data.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-22

SC-22 Architecture and Provisioning for Name/Address Resolution Service
Family: System and Communications Protection (SC)

Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-22 > Discussion

SC-22 Architecture and Provisioning for Name/Address Resolution Service - Discussion
Family: System and Communications Protection (SC)

Systems that provide name and address resolution services include domain name system (DNS) servers. To eliminate single points of failure in systems and enhance redundancy, organizations employ at least two authoritative domain name system servers-one configured as the primary server and the other configured as the secondary server. Additionally, organizations typically deploy the servers in two geographically separated network subnetworks (i.e., not located in the same physical facility). For role separation, DNS servers with internal roles only process name and address resolution requests from within organizations (i.e., from internal clients). DNS servers with external roles only process name and address resolution information requests from clients external to organizations (i.e., on external networks, including the Internet). Organizations specify clients that can access authoritative DNS servers in certain roles (e.g., by address ranges and explicit lists).
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23

SC-23 Session Authenticity
Family: System and Communications Protection (SC)

Protect the authenticity of communications sessions.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23 > Discussion

SC-23 Session Authenticity - Discussion
Family: System and Communications Protection (SC)

Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against "man-in-the-middle" attacks, session hijacking, and the insertion of false information into sessions.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23 > SC-23(1) > Discussion

SC-23(1) Invalidate Session Identifiers at Logout - Discussion
Family: System and Communications Protection (SC) > SC-23 Session Authenticity

Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23 > SC-23(1)

SC-23(1) Session Authenticity | Invalidate Session Identifiers at Logout
Family: System and Communications Protection (SC) > SC-23 Session Authenticity

Invalidate session identifiers upon user logout or other session termination.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23 > SC-23(3) > Discussion

SC-23(3) Unique System-generated Session Identifiers - Discussion
Family: System and Communications Protection (SC) > SC-23 Session Authenticity

Generating unique session identifiers curtails the ability of adversaries to reuse previously valid session IDs. Employing the concept of randomness in the generation of unique session identifiers protects against brute-force attacks to determine future session identifiers.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23 > SC-23(3)

SC-23(3) Session Authenticity | Unique System-generated Session Identifiers
Family: System and Communications Protection (SC) > SC-23 Session Authenticity

Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23 > SC-23(5) > Discussion

SC-23(5) Allowed Certificate Authorities - Discussion
Family: System and Communications Protection (SC) > SC-23 Session Authenticity

Reliance on certificate authorities for the establishment of secure sessions includes the use of Transport Layer Security (TLS) certificates. These certificates, after verification by their respective certificate authorities, facilitate the establishment of protected sessions between web clients and web servers.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-23 > SC-23(5)

SC-23(5) Session Authenticity | Allowed Certificate Authorities
Family: System and Communications Protection (SC) > SC-23 Session Authenticity

Only allow the use of [Assignment: organization-defined certificated authorities] for verification of the establishment of protected sessions.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-24

SC-24 Fail in Known State
Family: System and Communications Protection (SC)

Fail to a [Assignment: organization-defined known system state] for the following failures on the indicated components while preserving [Assignment: organization-defined system state information] in failure: [Assignment: organization-defined types of system failures on system components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-24 > Discussion

SC-24 Fail in Known State - Discussion
Family: System and Communications Protection (SC)

Failure in a known state addresses security concerns in accordance with the mission and business needs of organizations. Failure in a known state prevents the loss of confidentiality, integrity, or availability of information in the event of failures of organizational systems or system components. Failure in a known safe state helps to prevent systems from failing to a state that may cause injury to individuals or destruction to property. Preserving system state information facilitates system restart and return to the operational mode with less disruption of mission and business processes.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-25

SC-25 Thin Nodes
Family: System and Communications Protection (SC)

Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-25 > Discussion

SC-25 Thin Nodes - Discussion
Family: System and Communications Protection (SC)

The deployment of system components with minimal functionality reduces the need to secure every endpoint and may reduce the exposure of information, systems, and services to attacks. Reduced or minimal functionality includes diskless nodes and thin client technologies.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-26

SC-26 Decoys
Family: System and Communications Protection (SC)

Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.