ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > Assessment Objective

CM-7 Least Functionality - Assessment Objective
Determine if the following are satisfied:

CM-07a. the system is configured to provide only [Assignment: organization-defined mission-essential capabilities];
CM-07b.[01] the use of [Assignment: organization-defined functions] is prohibited or restricted;
CM-07b.[02] the use of [Assignment: organization-defined ports] is prohibited or restricted;
CM-07b.[03] the use of [Assignment: organization-defined protocols] is prohibited or restricted;
CM-07b.[04] the use of [Assignment: organization-defined software] is prohibited or restricted;
CM-07b.[05] the use of [Assignment: organization-defined services] is prohibited or restricted.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(1) > Assessment Methods

CM-7(1) Periodic Review - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

common secure configuration checklists

documented reviews of functions, ports, protocols, and/or services

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for reviewing functions, ports, protocols, and services on the system

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Organizational processes for reviewing or disabling functions, ports, protocols, and services on the system

mechanisms implementing review and disabling of functions, ports, protocols, and/or services
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(1) > Assessment Objective

CM-7(1) Periodic Review - Assessment Objective
Determine if the following are satisfied:

CM-07(01)(a) the system is reviewed [Assignment: organization-defined frequency] to identify unnecessary and/or non-secure functions, ports, protocols, software, and services:
CM-07(01)(b)[01] [Assignment: organization-defined functions] deemed to be unnecessary and/or non-secure are disabled or removed;
CM-07(01)(b)[02] [Assignment: organization-defined ports] deemed to be unnecessary and/or non-secure are disabled or removed;
CM-07(01)(b)[03] [Assignment: organization-defined protocols] deemed to be unnecessary and/or non-secure are disabled or removed;
CM-07(01)(b)[04] [Assignment: organization-defined software] deemed to be unnecessary and/or non-secure is disabled or removed;
CM-07(01)(b)[05] [Assignment: organization-defined services] deemed to be unnecessary and/or non-secure are disabled or removed.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(2) > Assessment Methods

CM-7(2) Prevent Program Execution - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

system component inventory

common secure configuration checklists

specifications for preventing software program execution

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Organizational processes preventing program execution on the system

organizational processes for software program usage and restrictions

mechanisms preventing program execution on the system

mechanisms supporting and/or implementing software program usage and restrictions
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(2) > Assessment Objective

CM-7(2) Prevent Program Execution - Assessment Objective
Determine if the following are satisfied:

program execution is prevented in accordance with [Selection; one or more: [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions] ; rules authorizing the terms and conditions of software program usage].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(3) > Assessment Methods

CM-7(3) Registration Compliance - Assessment Methods and Objects

Examine: System security plan

configuration management policy

procedures addressing least functionality in the system

configuration management plan

system configuration settings and associated documentation

system component inventory

audit and compliance reviews

system audit records

other relevant documents or records

Interview: Organizational personnel with security responsibilities

system/network administrators

system developers

Test: Organizational processes ensuring compliance with registration requirements for functions, ports, protocols, and/or services

mechanisms implementing compliance with registration requirements for functions, ports, protocols, and/or services
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(3) > Assessment Objective

CM-7(3) Registration Compliance - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined registration requirements] are complied with.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(4) > Assessment Methods

CM-7(4) Unauthorized Software - Deny-by-exception - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

list of software programs not authorized to execute on the system

system component inventory

common secure configuration checklists

review and update records associated with list of unauthorized software programs

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for identifying software not authorized to execute on the system

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational process for identifying, reviewing, and updating programs not authorized to execute on the system

organizational process for implementing unauthorized software policy

mechanisms supporting and/or implementing unauthorized software policy
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(4) > Assessment Objective

CM-7(4) Unauthorized Software - Deny-by-exception - Assessment Objective
Determine if the following are satisfied:

CM-07(04)(a) [Assignment: organization-defined software programs] are identified;
CM-07(04)(b) an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system;
CM-07(04)(c) the list of unauthorized software programs is reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(5) > Assessment Methods

CM-7(5) Authorized Software - Allow-by-exception - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

list of software programs authorized to execute on the system

system component inventory

common secure configuration checklists

review and update records associated with list of authorized software programs

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for identifying software authorized to execute on the system

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational process for identifying, reviewing, and updating programs authorized to execute on the system

organizational process for implementing authorized software policy

mechanisms supporting and/or implementing authorized software policy
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(5) > Assessment Objective

CM-7(5) Authorized Software - Allow-by-exception - Assessment Objective
Determine if the following are satisfied:

CM-07(05)(a) [Assignment: organization-defined software programs] are identified;
CM-07(05)(b) a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system is employed;
CM-07(05)(c) the list of authorized software programs is reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(6) > Assessment Methods

CM-7(6) Confined Environments with Limited Privileges - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

list or record of software required to execute in a confined environment

system component inventory

common secure configuration checklists

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for identifying and/or managing user-installed software and associated privileges

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational process for identifying user-installed software required to execute in a confined environment

mechanisms supporting and/or implementing the confinement of user-installed software to physical or virtual machine environments

mechanisms supporting and/or implementing privilege limitations on user-installed software
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(6) > Assessment Objective

CM-7(6) Confined Environments with Limited Privileges - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined user-installed software] is required to be executed in a confined physical or virtual machine environment with limited privileges.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(7) > Assessment Methods

CM-7(7) Code Execution in Protected Environments - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

list or record of binary or machine-executable code

system component inventory

common secure configuration checklists

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for approving execution of binary or machine-executable code

organizational personnel with information security responsibilities

organizational personnel with software management responsibilities

system/network administrators

system developers

Test: Organizational process for approving execution of binary or machine-executable code

organizational process for confining binary or machine-executable code to physical or virtual machine environments

mechanisms supporting and/or implementing the confinement of binary or machine-executable code to physical or virtual machine environments
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(7) > Assessment Objective

CM-7(7) Code Execution in Protected Environments - Assessment Objective
Determine if the following are satisfied:

the execution of binary or machine-executable code is only allowed in confined physical or virtual machine environments;
CM-07(07)(a) the execution of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of [Assignment: organization-defined personnel or roles];
CM-07(07)(b) the execution of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(8) > Assessment Methods

CM-7(8) Binary or Machine Executable Code - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system security plan

system design documentation

system configuration settings and associated documentation

list or record of binary or machine-executable code

system component inventory

common secure configuration checklists

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for determining mission and operational requirements

authorizing official for the system

organizational personnel with information security responsibilities

organizational personnel with software management responsibilities

system/network administrators

Test: Organizational process for approving execution of binary or machine-executable code

mechanisms supporting and/or implementing the prohibition of binary or machine-executable code
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(8) > Assessment Objective

CM-7(8) Binary or Machine Executable Code - Assessment Objective
Determine if the following are satisfied:

CM-07(08)(a) the use of binary or machine-executable code is prohibited when it originates from sources with limited or no warranty or without the provision of source code;
CM-07(08)(b)[01] exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only for compelling mission or operational requirements;
CM-07(08)(b)[02] exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only with the approval of the authorizing official.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(9) > Assessment Methods

CM-7(9) Prohibiting The Use of Unauthorized Hardware - Assessment Methods and Objects

Examine: Configuration management policy

network connection policy and procedures

configuration management plan

system security plan

system design documentation

system component inventory

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system hardware management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational process for approving execution of binary or machine-executable code

mechanisms supporting and/or implementing the prohibition of binary or machine-executable code
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > CM-7(9) > Assessment Objective

CM-7(9) Prohibiting The Use of Unauthorized Hardware - Assessment Objective
Determine if the following are satisfied:

CM-07(09)(a) [Assignment: organization-defined hardware components] are identified;
CM-07(09)(b) the use or connection of unauthorized hardware components is prohibited;
CM-07(09)(c) the list of authorized hardware components is reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > Assessment Methods

CM-8 System Component Inventory - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system security plan

system design documentation

system component inventory

inventory reviews and update records

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing the system component inventory

mechanisms supporting and/or implementing system component inventory
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > Assessment Objective

CM-8 System Component Inventory - Assessment Objective
Determine if the following are satisfied:

CM-08a.01 an inventory of system components that accurately reflects the system is developed and documented;
CM-08a.02 an inventory of system components that includes all components within the system is developed and documented;
CM-08a.03 an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented;
CM-08a.04 an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented;
CM-08a.05 an inventory of system components that includes [Assignment: organization-defined information] is developed and documented;
CM-08b. the system component inventory is reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(1) > Assessment Methods

CM-8(1) Updates During Installation and Removal - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system security plan

system component inventory

inventory reviews and update records

change control records

component installation records

component removal records

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory updating responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for updating the system component inventory

mechanisms supporting and/or implementing system component inventory updates
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(1) > Assessment Objective

CM-8(1) Updates During Installation and Removal - Assessment Objective
Determine if the following are satisfied:

CM-08(01)[01] the inventory of system components is updated as part of component installations;
CM-08(01)[02] the inventory of system components is updated as part of component removals;
CM-08(01)[03] the inventory of system components is updated as part of system updates.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(2) > Assessment Methods

CM-8(2) Automated Maintenance - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system design documentation

system security plan

system component inventory

change control records

system maintenance records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Organizational processes for maintaining the system component inventory

automated mechanisms supporting and/or implementing the system component inventory
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(2) > Assessment Objective

CM-8(2) Automated Maintenance - Assessment Objective
Determine if the following are satisfied:

CM-08(02)[01] [Assignment: organization-defined automated mechanisms] are used to maintain the currency of the system component inventory;
CM-08(02)[02] [Assignment: organization-defined automated mechanisms] are used to maintain the completeness of the system component inventory;
CM-08(02)[03] [Assignment: organization-defined automated mechanisms] are used to maintain the accuracy of the system component inventory;
CM-08(02)[04] [Assignment: organization-defined automated mechanisms] are used to maintain the availability of the system component inventory.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(3) > Assessment Methods

CM-8(3) Automated Unauthorized Component Detection - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system component inventory

configuration management plan

system design documentation

system security plan

system component inventory

change control records

alerts/notifications of unauthorized components within the system

system monitoring records

system maintenance records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with component inventory management responsibilities

organizational personnel with responsibilities for managing the automated mechanisms implementing unauthorized system component detection

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Organizational processes for detection of unauthorized system components

organizational processes for taking action when unauthorized system components are detected

automated mechanisms supporting and/or implementing the detection of unauthorized system components

automated mechanisms supporting and/or implementing actions taken when unauthorized system components are detected
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-8 > CM-8(3) > Assessment Objective

CM-8(3) Automated Unauthorized Component Detection - Assessment Objective
Determine if the following are satisfied:

CM-08(03)(a)[01] the presence of unauthorized hardware within the system is detected using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency];
CM-08(03)(a)[02] the presence of unauthorized software within the system is detected using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency];
CM-08(03)(a)[03] the presence of unauthorized firmware within the system is detected using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency];
CM-08(03)(b)[01] [Selection; one or more: disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: organization-defined personnel or roles] ] are taken when unauthorized hardware is detected;
CM-08(03)(b)[02] [Selection; one or more: disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: organization-defined personnel or roles] ] are taken when unauthorized software is detected;
CM-08(03)(b)[03] [Selection; one or more: disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: organization-defined personnel or roles] ] are taken when unauthorized firmware is detected.