ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-5 > SR-5(1) > Assessment Methods

SR-5(1) Adequate Supply - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management strategy

supply chain risk management plan

contingency planning documents

inventory of critical systems and system components

determination of adequate supply

system and services acquisition policy

procedures addressing supply chain protection

procedures addressing the integration of information security requirements into the acquisition process

procedures addressing the integration of acquisition strategies, contract tools, and procurement methods into the acquisition process

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for systems or services

purchase orders/requisitions for the system, system component, or system service from suppliers

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods

mechanisms supporting and/or implementing the definition and employment of tailored acquisition strategies, contract tools, and procurement methods
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-5 > SR-5(1) > Assessment Objective

SR-5(1) Adequate Supply - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls] are employed to ensure an adequate supply of [Assignment: organization-defined critical system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-5 > SR-5(2) > Assessment Methods

SR-5(2) Assessments Prior to Selection, Acceptance, Modification, or Update - Assessment Methods and Objects

Examine: System security plan

system and services acquisition policy

procedures addressing supply chain protection

procedures addressing the integration of information security requirements into the acquisition process

security test and evaluation results

vulnerability assessment results

penetration testing results

organizational risk assessment results

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain protection responsibilities

Test: Organizational processes for conducting assessments prior to selection, acceptance, or update

mechanisms supporting and/or implementing the conducting of assessments prior to selection, acceptance, or update
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-5 > SR-5(2) > Assessment Objective

SR-5(2) Assessments Prior to Selection, Acceptance, Modification, or Update - Assessment Objective
Determine if the following are satisfied:

SR-05(02)[01] the system, system component, or system service is assessed prior to selection;
SR-05(02)[02] the system, system component, or system service is assessed prior to acceptance;
SR-05(02)[03] the system, system component, or system service is assessed prior to modification;
SR-05(02)[04] the system, system component, or system service is assessed prior to update.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-6 > Assessment Methods

SR-6 Supplier Assessments and Reviews - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management strategy

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

procedures addressing the integration of information security requirements into the acquisition process

records of supplier due diligence reviews

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain protection responsibilities

Test: Organizational processes for conducting supplier reviews

mechanisms supporting and/or implementing supplier reviews
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-6 > Assessment Objective

SR-6 Supplier Assessments and Reviews - Assessment Objective
Determine if the following are satisfied:

the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-6 > SR-6(1) > Assessment Methods

SR-6(1) Testing and Analysis - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

evidence of organizational analysis, independent third-party analysis, organizational penetration testing, and/or independent third-party penetration testing

list of supply chain elements, processes, and actors (associated with the system, system component, or system service) subject to analysis and/or testing

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

organizational personnel with responsibilities for analyzing and/or testing supply chain elements, processes, and actors

Test: Organizational processes for defining and employing methods of analysis/testing of supply chain elements, processes, and actors

mechanisms supporting and/or implementing the analysis/testing of supply chain elements, processes, and actors
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-6 > SR-6(1) > Assessment Objective

SR-6(1) Testing and Analysis - Assessment Objective
Determine if the following are satisfied:

[Selection; one or more: organizational analysis; independent third-party analysis; organizational testing; independent third-party testing] is/are employed on [Assignment: organization-defined supply chain elements, processes, and actors] associated with the system, system component, or system service.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-7 > Assessment Methods

SR-7 Supply Chain Operations Security - Assessment Methods and Objects

Examine: Supply chain risk management plan

supply chain risk management procedures

system and services acquisition policy

system and services acquisition procedures

procedures addressing supply chain protection

list of OPSEC controls to be employed

solicitation documentation

acquisition documentation

acquisition contracts for the system, system component, or system service

records of all-source intelligence analyses

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with OPSEC responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and employing OPSEC safeguards

mechanisms supporting and/or implementing the definition and employment of OPSEC safeguards
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-7 > Assessment Objective

SR-7 Supply Chain Operations Security - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined OPSEC controls] are employed to protect supply chain-related information for the system, system component, or system service.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-8 > Assessment Methods

SR-8 Notification Agreements - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

inter-organizational agreements and procedures

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-8 > Assessment Objective

SR-8 Notification Agreements - Assessment Objective
Determine if the following are satisfied:

agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [Selection; one or more: notification of supply chain compromises; [Assignment: organization-defined results of assessments or audits] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-9 > Assessment Methods

SR-9 Tamper Resistance and Detection - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing supply chain protection

procedures addressing tamper resistance and detection

tamper protection program documentation

tamper protection tools and techniques documentation

tamper resistance and detection tools and techniques documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system security plan

other relevant documents or records

Interview: Organizational personnel with tamper protection program responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for the implementation of the tamper protection program

mechanisms supporting and/or implementing the tamper protection program
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-9 > Assessment Objective

SR-9 Tamper Resistance and Detection - Assessment Objective
Determine if the following are satisfied:

a tamper protection program is implemented for the system, system component, or system service.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-9 > SR-9(1) > Assessment Methods

SR-9(1) Multiple Stages of System Development Life Cycle - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

procedures addressing tamper resistance and detection

tamper protection program documentation

tamper protection tools and techniques documentation

tamper resistance and detection tools (technologies) and techniques documentation

system development life cycle documentation

procedures addressing supply chain protection

system development life cycle procedures

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

inter-organizational agreements and procedures

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

organizational personnel with SDLC responsibilities

Test: Organizational processes for employing anti-tamper technologies

mechanisms supporting and/or implementing anti-tamper technologies
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-9 > SR-9(1) > Assessment Objective

SR-9(1) Multiple Stages of System Development Life Cycle - Assessment Objective
Determine if the following are satisfied:

anti-tamper technologies, tools, and techniques are employed throughout the system development life cycle.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-10 > Assessment Methods

SR-10 Inspection of Systems or Components - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

records of random inspections

inspection reports/results

assessment reports/results

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

inter-organizational agreements and procedures

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities

organizational processes to inspect for tampering
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-10 > Assessment Objective

SR-10 Inspection of Systems or Components - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] are inspected [Selection; one or more: at random; at [Assignment: organization-defined frequency] ; upon [Assignment: organization-defined indications of need for inspection] ] to detect tampering.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > Assessment Methods

SR-11 Component Authenticity - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

anti-counterfeit plan

anti-counterfeit policy and procedures

media disposal policy

media protection policy

incident response policy

reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

inter-organizational agreements and procedures

records of reported counterfeit system components

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting

Test: Organizational processes for counterfeit prevention, detection, and reporting

mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > Assessment Objective

SR-11 Component Authenticity - Assessment Objective
Determine if the following are satisfied:

SR-11a.[01] an anti-counterfeit policy is developed and implemented;
SR-11a.[02] anti-counterfeit procedures are developed and implemented;
SR-11a.[03] the anti-counterfeit procedures include the means to detect counterfeit components entering the system;
SR-11a.[04] the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system;
SR-11b. counterfeit system components are reported to [Selection; one or more: source of counterfeit component; [Assignment: organization-defined external reporting organizations] ; [Assignment: organization-defined personnel or roles] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > SR-11(1) > Assessment Methods

SR-11(1) Anti-counterfeit Training - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

system and services acquisition policy

anti-counterfeit plan

anti-counterfeit policy and procedures

media disposal policy

media protection policy

incident response policy

training materials addressing counterfeit system components

training records on the detection and prevention of counterfeit components entering the system

system security plan

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

organizational personnel with responsibilities for anti-counterfeit policies, procedures, and training

Test: Organizational processes for anti-counterfeit training
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > SR-11(1) > Assessment Objective

SR-11(1) Anti-counterfeit Training - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined personnel or roles] are trained to detect counterfeit system components (including hardware, software, and firmware).
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > SR-11(2) > Assessment Methods

SR-11(2) Configuration Control for Component Service and Repair - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

configuration control procedures

acquisition documentation

service level agreements

acquisition contracts for the system component

inter-organizational agreements and procedures

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities

organizational configuration control processes
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > SR-11(2) > Assessment Objective

SR-11(2) Configuration Control for Component Service and Repair - Assessment Objective
Determine if the following are satisfied:

SR-11(02)[01] configuration control over [Assignment: organization-defined system components] awaiting service or repair is maintained;
SR-11(02)[02] configuration control over serviced or repaired [Assignment: organization-defined system components] awaiting return to service is maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > SR-11(3) > Assessment Methods

SR-11(3) Anti-counterfeit Scanning - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

anti-counterfeit policy and procedures

system design documentation

system configuration settings and associated documentation

scanning tools and associated documentation

scanning results

procedures addressing supply chain protection

acquisition documentation

inter-organizational agreements and procedures

system security plan

other relevant documents or records

Interview: Organizational personnel with system and services acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

organizational personnel with responsibilities for anti-counterfeit policies and procedures

organizational personnel with responsibility for anti-counterfeit scanning

Test: Organizational processes for scanning for counterfeit system components

mechanisms supporting and/or implementing anti-counterfeit scanning
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-11 > SR-11(3) > Assessment Objective

SR-11(3) Anti-counterfeit Scanning - Assessment Objective
Determine if the following are satisfied:

scanning for counterfeit system components is conducted [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-12 > Assessment Methods

SR-12 Component Disposal - Assessment Methods and Objects

Examine: Supply chain risk management policy and procedures

supply chain risk management plan

disposal procedures addressing supply chain protection

media disposal policy

media protection policy

disposal records for system components

documentation of the system components identified for disposal

documentation of the disposal techniques and methods employed for system components

system security plan

other relevant documents or records

Interview: Organizational personnel with system component disposal responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain protection responsibilities

Test: Organizational techniques and methods for system component disposal

mechanisms supporting and/or implementing system component disposal
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-12 > Assessment Objective

SR-12 Component Disposal - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined data, documentation, tools, or system components] are disposed of using [Assignment: organization-defined techniques and methods].
Control Baselines for Information Systems and Organizations — LOW baseline
SP 800-53B Baselines > LOW

SP 800-53B LOW baseline. Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 LOW IMPACT BASELINE. The LOW baseline selects 149 controls and control enhancements (131 base controls, 18 enhancements) from the SP 800-53 Rev 5 catalog. Selected control identifiers:

AC-1, AC-2, AC-3, AC-7, AC-8, AC-14, AC-17, AC-18, AC-19, AC-20, AC-22, AT-1, AT-2, AT-2(2), AT-3, AT-4, AU-1, AU-2, AU-3, AU-4, AU-5, AU-6, AU-8, AU-9, AU-11, AU-12, CA-1, CA-2, CA-3, CA-5, CA-6, CA-7, CA-7(4), CA-9, CM-1, CM-2, CM-4, CM-5, CM-6, CM-7, CM-8, CM-10, CM-11, CP-1, CP-2, CP-3, CP-4, CP-9, CP-10, IA-1, IA-2, IA-2(1), IA-2(2), IA-2(8), IA-2(12), IA-4, IA-5, IA-5(1), IA-6, IA-7, IA-8, IA-8(1), IA-8(2), IA-8(4), IA-11, IR-1, IR-2, IR-4, IR-5, IR-6, IR-7, IR-8, MA-1, MA-2, MA-4, MA-5, MP-1, MP-2, MP-6, MP-7, PE-1, PE-2, PE-3, PE-6, PE-8, PE-12, PE-13, PE-14, PE-15, PE-16, PL-1, PL-2, PL-4, PL-4(1), PL-10, PL-11, PS-1, PS-2, PS-3, PS-4, PS-5, PS-6, PS-7, PS-8, PS-9, RA-1, RA-2, RA-3, RA-3(1), RA-5, RA-5(2), RA-5(11), RA-7, SA-1, SA-2, SA-3, SA-4, SA-4(10), SA-5, SA-8, SA-9, SA-22, SC-1, SC-5, SC-7, SC-12, SC-13, SC-15, SC-20, SC-21, SC-22, SC-39, SI-1, SI-2, SI-3, SI-4, SI-5, SI-12, SR-1, SR-2, SR-2(1), SR-3, SR-5, SR-8, SR-10, SR-11, SR-11(1), SR-11(2), SR-12