ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
AC > AC-19 > Discussion

AC-19 Access Control for Mobile Devices - Discussion
Family: Access Control (AC)

A mobile device is a computing device that has a small form factor such that it can easily be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Mobile device functionality may also include voice communication capabilities, on-board sensors that allow the device to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones and tablets. Mobile devices are typically associated with a single individual. The processing, storage, and transmission capability of the mobile device may be comparable to or merely a subset of notebook/desktop systems, depending on the nature and intended purpose of the device. Protection and control of mobile devices is behavior or policy-based and requires users to take physical action to protect and control such devices when outside of controlled areas. Controlled areas are spaces for which organizations provide physical or procedural controls to meet the requirements established for protecting information and systems.

Due to the large variety of mobile devices with different characteristics and capabilities, organizational restrictions may vary for the different classes or types of such devices. Usage restrictions and specific implementation guidance for mobile devices include configuration management, device identification and authentication, implementation of mandatory protective software, scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware.

Usage restrictions and authorization to connect may vary among organizational systems. For example, the organization may authorize the connection of mobile devices to its network and impose a set of usage restrictions, while a system owner may withhold authorization for mobile device connection to specific applications or impose additional usage restrictions before allowing mobile device connections to a system. Adequate security for mobile devices goes beyond the requirements specified in [AC-19](#ac-19) . Many safeguards for mobile devices are reflected in other controls. [AC-20](#ac-20) addresses mobile devices that are not organization-controlled.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-19 > AC-19(4)

AC-19(4) Access Control for Mobile Devices | Restrictions for Classified Information
Family: Access Control (AC) > AC-19 Access Control for Mobile Devices

(a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and
(b) Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:
(1) Connection of unclassified mobile devices to classified systems is prohibited;
(2) Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official;
(3) Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and
(4) Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by [Assignment: organization-defined security officials] , and if classified information is found, the incident handling policy is followed.
(c) Restrict the connection of classified mobile devices to classified systems in accordance with [Assignment: organization-defined security policies].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-19 > AC-19(5) > Discussion

AC-19(5) Full Device or Container-based Encryption - Discussion
Family: Access Control (AC) > AC-19 Access Control for Mobile Devices

Container-based encryption provides a more fine-grained approach to data and information encryption on mobile devices, including encrypting selected data structures such as files, records, or fields.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-19 > AC-19(5)

AC-19(5) Access Control for Mobile Devices | Full Device or Container-based Encryption
Family: Access Control (AC) > AC-19 Access Control for Mobile Devices

Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20

AC-20 Use of External Systems
Family: Access Control (AC)

a. [Selection; one or more: establish [Assignment: organization-defined terms and conditions] ; identify [Assignment: organization-defined controls asserted] ] , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:
1. Access the system from external systems; and
2. Process, store, or transmit organization-controlled information using external systems; or
b. Prohibit the use of [Assignment: organization-defined prohibited types of external systems].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > Discussion

AC-20 Use of External Systems - Discussion
Family: Access Control (AC)

External systems are systems that are used by but not part of organizational systems, and for which the organization has no direct control over the implementation of required controls or the assessment of control effectiveness. External systems include personally owned systems, components, or devices; privately owned computing and communications devices in commercial or public facilities; systems owned or controlled by nonfederal organizations; systems managed by contractors; and federal information systems that are not owned by, operated by, or under the direct supervision or authority of the organization. External systems also include systems owned or operated by other components within the same organization and systems within the organization with different authorization boundaries. Organizations have the option to prohibit the use of any type of external system or prohibit the use of specified types of external systems, (e.g., prohibit the use of any external system that is not organizationally owned or prohibit the use of personally-owned systems).

For some external systems (i.e., systems operated by other organizations), the trust relationships that have been established between those organizations and the originating organization may be such that no explicit terms and conditions are required. Systems within these organizations may not be considered external. These situations occur when, for example, there are pre-existing information exchange agreements (either implicit or explicit) established between organizations or components or when such agreements are specified by applicable laws, executive orders, directives, regulations, policies, or standards. Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to organizational systems and over which organizations have the authority to impose specific rules of behavior regarding system access. Restrictions that organizations impose on authorized individuals need not be uniform, as the restrictions may vary depending on trust relationships between organizations. Therefore, organizations may choose to impose different security restrictions on contractors than on state, local, or tribal governments.

External systems used to access public interfaces to organizational systems are outside the scope of [AC-20](#ac-20) . Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(1) > Discussion

AC-20(1) Limits on Authorized Use - Discussion
Family: Access Control (AC) > AC-20 Use of External Systems

Limiting authorized use recognizes circumstances where individuals using external systems may need to access organizational systems. Organizations need assurance that the external systems contain the necessary controls so as not to compromise, damage, or otherwise harm organizational systems. Verification that the required controls have been implemented can be achieved by external, independent assessments, attestations, or other means, depending on the confidence level required by organizations.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(1)

AC-20(1) Use of External Systems | Limits on Authorized Use
Family: Access Control (AC) > AC-20 Use of External Systems

Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:
(a) Verification of the implementation of controls on the external system as specified in the organization's security and privacy policies and security and privacy plans; or
(b) Retention of approved system connection or processing agreements with the organizational entity hosting the external system.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(2) > Discussion

AC-20(2) Portable Storage Devices - Restricted Use - Discussion
Family: Access Control (AC) > AC-20 Use of External Systems

Limits on the use of organization-controlled portable storage devices in external systems include restrictions on how the devices may be used and under what conditions the devices may be used.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(2)

AC-20(2) Use of External Systems | Portable Storage Devices - Restricted Use
Family: Access Control (AC) > AC-20 Use of External Systems

Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(3) > Discussion

AC-20(3) Non-organizationally Owned Systems - Restricted Use - Discussion
Family: Access Control (AC) > AC-20 Use of External Systems

Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. There are potential risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use (see [AC-20 b.](#ac-20_smt.b) ). In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved controls prior to authorizing the connection of non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to servers or system components provisioned by the organization; and agreeing to the terms and conditions for usage. Organizations consult with the Office of the General Counsel regarding legal issues associated with using personally owned devices, including requirements for conducting forensic analyses during investigations after an incident.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(3)

AC-20(3) Use of External Systems | Non-organizationally Owned Systems - Restricted Use
Family: Access Control (AC) > AC-20 Use of External Systems

Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: organization-defined restrictions].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(4) > Discussion

AC-20(4) Network Accessible Storage Devices - Prohibited Use - Discussion
Family: Access Control (AC) > AC-20 Use of External Systems

Network-accessible storage devices in external systems include online storage devices in public, hybrid, or community cloud-based systems.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(4)

AC-20(4) Use of External Systems | Network Accessible Storage Devices - Prohibited Use
Family: Access Control (AC) > AC-20 Use of External Systems

Prohibit the use of [Assignment: organization-defined network-accessible storage devices] in external systems.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(5) > Discussion

AC-20(5) Portable Storage Devices - Prohibited Use - Discussion
Family: Access Control (AC) > AC-20 Use of External Systems

Limits on the use of organization-controlled portable storage devices in external systems include a complete prohibition of the use of such devices. Prohibiting such use is enforced using technical methods and/or nontechnical (i.e., process-based) methods.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-20 > AC-20(5)

AC-20(5) Use of External Systems | Portable Storage Devices - Prohibited Use
Family: Access Control (AC) > AC-20 Use of External Systems

Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-21

AC-21 Information Sharing
Family: Access Control (AC)

a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information's access and use restrictions for [Assignment: organization-defined information-sharing circumstances] ; and
b. Employ [Assignment: organization-defined automated mechanisms] to assist users in making information sharing and collaboration decisions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-21 > Discussion

AC-21 Information Sharing - Discussion
Family: Access Control (AC)

Information sharing applies to information that may be restricted in some manner based on some formal or administrative determination. Examples of such information include, contract-sensitive information, classified information related to special access programs or compartments, privileged information, proprietary information, and personally identifiable information. Security and privacy risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to these determinations. Depending on the circumstances, sharing partners may be defined at the individual, group, or organizational level. Information may be defined by content, type, security category, or special access program or compartment. Access restrictions may include non-disclosure agreements (NDA). Information flow techniques and security attributes may be used to provide automated assistance to users making sharing and collaboration decisions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-21 > AC-21(1) > Discussion

AC-21(1) Automated Decision Support - Discussion
Family: Access Control (AC) > AC-21 Information Sharing

Automated mechanisms are used to enforce information sharing decisions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-21 > AC-21(1)

AC-21(1) Information Sharing | Automated Decision Support
Family: Access Control (AC) > AC-21 Information Sharing

Employ [Assignment: organization-defined automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-21 > AC-21(2) > Discussion

AC-21(2) Information Search and Retrieval - Discussion
Family: Access Control (AC) > AC-21 Information Sharing

Information search and retrieval services identify information system resources relevant to an information need.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-21 > AC-21(2)

AC-21(2) Information Sharing | Information Search and Retrieval
Family: Access Control (AC) > AC-21 Information Sharing

Implement information search and retrieval services that enforce [Assignment: organization-defined information-sharing restrictions].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-22

AC-22 Publicly Accessible Content
Family: Access Control (AC)

a. Designate individuals authorized to make information publicly accessible;
b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and
d. Review the content on the publicly accessible system for nonpublic information [Assignment: organization-defined frequency] and remove such information, if discovered.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-22 > Discussion

AC-22 Publicly Accessible Content - Discussion
Family: Access Control (AC)

In accordance with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines, the public is not authorized to have access to nonpublic information, including information protected under the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) and proprietary information. Publicly accessible content addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Posting information on non-organizational systems (e.g., non-organizational public websites, forums, and social media) is covered by organizational policy. While organizations may have individuals who are responsible for developing and implementing policies about the information that can be made publicly accessible, publicly accessible content addresses the management of the individuals who make such information publicly accessible.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-23

AC-23 Data Mining Protection
Family: Access Control (AC)

Employ [Assignment: organization-defined techniques] for [Assignment: organization-defined data storage objects] to detect and protect against unauthorized data mining.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-23 > Discussion

AC-23 Data Mining Protection - Discussion
Family: Access Control (AC)

Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, [AU-13](#au-13) focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.

[EO 13587](#0af071a6-cf8e-48ee-8c82-fe91efa20f94) requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-24

AC-24 Access Control Decisions
Family: Access Control (AC)

[Selection; one or more: establish procedures; implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-24 > Discussion

AC-24 Access Control Decisions - Discussion
Family: Access Control (AC)

Access control decisions (also known as authorization decisions) occur when authorization information is applied to specific accesses. In contrast, access enforcement occurs when systems enforce access control decisions. While it is common to have access control decisions and access enforcement implemented by the same entity, it is not required, and it is not always an optimal implementation choice. For some architectures and distributed systems, different entities may make access control decisions and enforce access.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-24 > AC-24(1) > Discussion

AC-24(1) Transmit Access Authorization Information - Discussion
Family: Access Control (AC) > AC-24 Access Control Decisions

Authorization processes and access control decisions may occur in separate parts of systems or in separate systems. In such instances, authorization information is transmitted securely (e.g., using cryptographic mechanisms) so that timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information supporting security and privacy attributes. This is because in distributed systems, there are various access control decisions that need to be made, and different entities make these decisions in a serial fashion, each requiring those attributes to make the decisions. Protecting access authorization information ensures that such information cannot be altered, spoofed, or compromised during transmission.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-24 > AC-24(1)

AC-24(1) Access Control Decisions | Transmit Access Authorization Information
Family: Access Control (AC) > AC-24 Access Control Decisions

Transmit [Assignment: organization-defined access authorization information] using [Assignment: organization-defined controls] to [Assignment: organization-defined systems] that enforce access control decisions.