ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
PE > PE-14 > PE-14(2) > Discussion

PE-14(2) Monitoring with Alarms and Notifications - Discussion
Family: Physical and Environmental Protection (PE) > PE-14 Environmental Controls

The alarm or notification may be an audible alarm or a visual message in real time to personnel or roles defined by the organization. Such alarms and notifications can help minimize harm to individuals and damage to organizational assets by facilitating a timely incident response.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-14 > PE-14(2)

PE-14(2) Environmental Controls | Monitoring with Alarms and Notifications
Family: Physical and Environmental Protection (PE) > PE-14 Environmental Controls

Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [Assignment: organization-defined personnel or roles].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-15

PE-15 Water Damage Protection
Family: Physical and Environmental Protection (PE)

Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-15 > Discussion

PE-15 Water Damage Protection - Discussion
Family: Physical and Environmental Protection (PE)

The provision of water damage protection primarily applies to organizational facilities that contain concentrations of system resources, including data centers, server rooms, and mainframe computer rooms. Isolation valves can be employed in addition to or in lieu of master shutoff valves to shut off water supplies in specific areas of concern without affecting entire organizations.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-15 > PE-15(1) > Discussion

PE-15(1) Automation Support - Discussion
Family: Physical and Environmental Protection (PE) > PE-15 Water Damage Protection

Automated mechanisms include notification systems, water detection sensors, and alarms.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-15 > PE-15(1)

PE-15(1) Water Damage Protection | Automation Support
Family: Physical and Environmental Protection (PE) > PE-15 Water Damage Protection

Detect the presence of water near the system and alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-16

PE-16 Delivery and Removal
Family: Physical and Environmental Protection (PE)

a. Authorize and control [Assignment: organization-defined organization-defined types of system components] entering and exiting the facility; and
b. Maintain records of the system components.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-16 > Discussion

PE-16 Delivery and Removal - Discussion
Family: Physical and Environmental Protection (PE)

Enforcing authorizations for entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-17

PE-17 Alternate Work Site
Family: Physical and Environmental Protection (PE)

a. Determine and document the [Assignment: organization-defined alternate work sites] allowed for use by employees;
b. Employ the following controls at alternate work sites: [Assignment: organization-defined controls];
c. Assess the effectiveness of controls at alternate work sites; and
d. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-17 > Discussion

PE-17 Alternate Work Site - Discussion
Family: Physical and Environmental Protection (PE)

Alternate work sites include government facilities or the private residences of employees. While distinct from alternative processing sites, alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different sets of controls for specific alternate work sites or types of sites depending on the work-related activities conducted at the sites. Implementing and assessing the effectiveness of organization-defined controls and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-18

PE-18 Location of System Components
Family: Physical and Environmental Protection (PE)

Position system components within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-18 > Discussion

PE-18 Location of System Components - Discussion
Family: Physical and Environmental Protection (PE)

Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, an electromagnetic pulse, electrical interference, and other forms of incoming electromagnetic radiation. Organizations consider the location of entry points where unauthorized individuals, while not being granted access, might nonetheless be near systems. Such proximity can increase the risk of unauthorized access to organizational communications using wireless packet sniffers or microphones, or unauthorized disclosure of information.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-19

PE-19 Information Leakage
Family: Physical and Environmental Protection (PE)

Protect the system from information leakage due to electromagnetic signals emanations.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-19 > Discussion

PE-19 Information Leakage - Discussion
Family: Physical and Environmental Protection (PE)

Information leakage is the intentional or unintentional release of data or information to an untrusted environment from electromagnetic signals emanations. The security categories or classifications of systems (with respect to confidentiality), organizational security policies, and risk tolerance guide the selection of controls employed to protect systems against information leakage due to electromagnetic signals emanations.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-19 > PE-19(1) > Discussion

PE-19(1) National Emissions Policies and Procedures - Discussion
Family: Physical and Environmental Protection (PE) > PE-19 Information Leakage

Emissions Security (EMSEC) policies include the former TEMPEST policies.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-19 > PE-19(1)

PE-19(1) Information Leakage | National Emissions Policies and Procedures
Family: Physical and Environmental Protection (PE) > PE-19 Information Leakage

Protect system components, associated data communications, and networks in accordance with national Emissions Security policies and procedures based on the security category or classification of the information.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-20

PE-20 Asset Monitoring and Tracking
Family: Physical and Environmental Protection (PE)

Employ [Assignment: organization-defined asset location technologies] to track and monitor the location and movement of [Assignment: organization-defined assets] within [Assignment: organization-defined controlled areas].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-20 > Discussion

PE-20 Asset Monitoring and Tracking - Discussion
Family: Physical and Environmental Protection (PE)

Asset location technologies can help ensure that critical assets-including vehicles, equipment, and system components-remain in authorized locations. Organizations consult with the Office of the General Counsel and senior agency official for privacy regarding the deployment and use of asset location technologies to address potential privacy concerns.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-21

PE-21 Electromagnetic Pulse Protection
Family: Physical and Environmental Protection (PE)

Employ [Assignment: organization-defined protective measures] against electromagnetic pulse damage for [Assignment: organization-defined system and system components].
Security and Privacy Controls for Information Systems and Organizations
PE > PE-21 > Discussion

PE-21 Electromagnetic Pulse Protection - Discussion
Family: Physical and Environmental Protection (PE)

An electromagnetic pulse (EMP) is a short burst of electromagnetic energy that is spread over a range of frequencies. Such energy bursts may be natural or man-made. EMP interference may be disruptive or damaging to electronic equipment. Protective measures used to mitigate EMP risk include shielding, surge suppressors, ferro-resonant transformers, and earth grounding. EMP protection may be especially significant for systems and applications that are part of the U.S. critical infrastructure.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-22

PE-22 Component Marking
Family: Physical and Environmental Protection (PE)

Mark [Assignment: organization-defined system hardware components] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-22 > Discussion

PE-22 Component Marking - Discussion
Family: Physical and Environmental Protection (PE)

Hardware components that may require marking include input and output devices. Input devices include desktop and notebook computers, keyboards, tablets, and smart phones. Output devices include printers, monitors/video displays, facsimile machines, scanners, copiers, and audio devices. Permissions controlling output to the output devices are addressed in [AC-3](#ac-3) or [AC-4](#ac-4) . Components are marked to indicate the impact level or classification level of the system to which the devices are connected, or the impact level or classification level of the information permitted to be output. Security marking refers to the use of human-readable security attributes. Security labeling refers to the use of security attributes for internal system data structures. Security marking is generally not required for hardware components that process, store, or transmit information determined by organizations to be in the public domain or to be publicly releasable. However, organizations may require markings for hardware components that process, store, or transmit public information in order to indicate that such information is publicly releasable. Marking of system hardware components reflects applicable laws, executive orders, directives, policies, regulations, and standards.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-23

PE-23 Facility Location
Family: Physical and Environmental Protection (PE)

a. Plan the location or site of the facility where the system resides considering physical and environmental hazards; and
b. For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.
Security and Privacy Controls for Information Systems and Organizations
PE > PE-23 > Discussion

PE-23 Facility Location - Discussion
Family: Physical and Environmental Protection (PE)

Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terrorism, vandalism, an electromagnetic pulse, electrical interference, and other forms of incoming electromagnetic radiation. The location of system components within the facility is addressed in [PE-18](#pe-18).
Security and Privacy Controls for Information Systems and Organizations
PL > PL-1

PL-1 Policy and Procedures
Family: Planning (PL)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] planning policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the planning policy and the associated planning controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the planning policy and procedures; and
c. Review and update the current planning:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
PL > PL-1 > Discussion

PL-1 Policy and Procedures - Discussion
Family: Planning (PL)

Planning policy and procedures for the controls in the PL family implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on their development. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission level or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission/business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to planning policy and procedures include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
PL > PL-2

PL-2 System Security and Privacy Plans
Family: Planning (PL)

a. Develop security and privacy plans for the system that:
1. Are consistent with the organization's enterprise architecture;
2. Explicitly define the constituent system components;
3. Describe the operational context of the system in terms of mission and business processes;
4. Identify the individuals that fulfill system roles and responsibilities;
5. Identify the information types processed, stored, and transmitted by the system;
6. Provide the security categorization of the system, including supporting rationale;
7. Describe any specific threats to the system that are of concern to the organization;
8. Provide the results of a privacy risk assessment for systems processing personally identifiable information;
9. Describe the operational environment for the system and any dependencies on or connections to other systems or system components;
10. Provide an overview of the security and privacy requirements for the system;
11. Identify any relevant control baselines or overlays, if applicable;
12. Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;
13. Include risk determinations for security and privacy architecture and design decisions;
14. Include security- and privacy-related activities affecting the system that require planning and coordination with [Assignment: organization-defined individuals or groups] ; and
15. Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.
b. Distribute copies of the plans and communicate subsequent changes to the plans to [Assignment: organization-defined personnel or roles];
c. Review the plans [Assignment: organization-defined frequency];
d. Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and
e. Protect the plans from unauthorized disclosure and modification.
Security and Privacy Controls for Information Systems and Organizations
PL > PL-4

PL-4 Rules of Behavior
Family: Planning (PL)

a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;
b. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;
c. Review and update the rules of behavior [Assignment: organization-defined frequency] ; and
d. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [Selection; one or more: [Assignment: organization-defined frequency] ; when the rules are revised or updated].
Security and Privacy Controls for Information Systems and Organizations
PL > PL-4 > Discussion

PL-4 Rules of Behavior - Discussion
Family: Planning (PL)

Rules of behavior represent a type of access agreement for organizational users. Other types of access agreements include nondisclosure agreements, conflict-of-interest agreements, and acceptable use agreements (see [PS-6](#ps-6) ). Organizations consider rules of behavior based on individual user roles and responsibilities and differentiate between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users, including individuals who receive information from federal systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for organizational and non-organizational users can also be established in [AC-8](#ac-8) . The related controls section provides a list of controls that are relevant to organizational rules of behavior. [PL-4b](#pl-4_smt.b) , the documented acknowledgment portion of the control, may be satisfied by the literacy training and awareness and role-based training programs conducted by organizations if such training includes rules of behavior. Documented acknowledgements for rules of behavior include electronic or physical signatures and electronic agreement check boxes or radio buttons.
Security and Privacy Controls for Information Systems and Organizations
PL > PL-4 > PL-4(1) > Discussion

PL-4(1) Social Media and External Site/Application Usage Restrictions - Discussion
Family: Planning (PL) > PL-4 Rules of Behavior

Social media, social networking, and external site/application usage restrictions address rules of behavior related to the use of social media, social networking, and external sites when organizational personnel are using such sites for official duties or in the conduct of official business, when organizational information is involved in social media and social networking transactions, and when personnel access social media and networking sites from organizational systems. Organizations also address specific rules that prevent unauthorized entities from obtaining non-public organizational information from social media and networking sites either directly or through inference. Non-public information includes personally identifiable information and system account information.
Security and Privacy Controls for Information Systems and Organizations
PL > PL-4 > PL-4(1)

PL-4(1) Rules of Behavior | Social Media and External Site/Application Usage Restrictions
Family: Planning (PL) > PL-4 Rules of Behavior

Include in the rules of behavior, restrictions on:
(a) Use of social media, social networking sites, and external sites/applications;
(b) Posting organizational information on public websites; and
(c) Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
Security and Privacy Controls for Information Systems and Organizations
PL > PL-7

PL-7 Concept of Operations
Family: Planning (PL)

a. Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy; and
b. Review and update the CONOPS [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
PL > PL-7 > Discussion

PL-7 Concept of Operations - Discussion
Family: Planning (PL)

The CONOPS may be included in the security or privacy plans for the system or in other system development life cycle documents. The CONOPS is a living document that requires updating throughout the system development life cycle. For example, during system design reviews, the concept of operations is checked to ensure that it remains consistent with the design for controls, the system architecture, and the operational procedures. Changes to the CONOPS are reflected in ongoing updates to the security and privacy plans, security and privacy architectures, and other organizational documents, such as procurement specifications, system development life cycle documents, and systems engineering documents.
Security and Privacy Controls for Information Systems and Organizations
PL > PL-8

PL-8 Security and Privacy Architectures
Family: Planning (PL)

a. Develop security and privacy architectures for the system that:
1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
3. Describe how the architectures are integrated into and support the enterprise architecture; and
4. Describe any assumptions about, and dependencies on, external systems and services;
b. Review and update the architectures [Assignment: organization-defined frequency] to reflect changes in the enterprise architecture; and
c. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.