ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-9 > Assessment Methods

PS-9 Position Descriptions - Assessment Methods and Objects

Examine: Personnel security policy

personnel security procedures

procedures addressing position descriptions

security and privacy position descriptions

system security plan

privacy plan

privacy program plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with human capital management responsibilities

Test: Organizational processes for managing position descriptions
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-9 > Assessment Objective

PS-9 Position Descriptions - Assessment Objective
Determine if the following are satisfied:

PS-09[01] security roles and responsibilities are incorporated into organizational position descriptions;
PS-09[02] privacy roles and responsibilities are incorporated into organizational position descriptions.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-1 > Assessment Methods

PT-1 Policy and Procedures - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy plan

privacy program plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-2 > Assessment Methods

PT-2 Authority to Process Personally Identifiable Information - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for authorizing the processing of personally identifiable information

mechanisms supporting and/or implementing the restriction of personally identifiable information processing
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-2 > Assessment Objective

PT-2 Authority to Process Personally Identifiable Information - Assessment Objective
Determine if the following are satisfied:

PT-02a. the [Assignment: organization-defined authority] that permits the [Assignment: organization-defined processing] of personally identifiable information is determined and documented;
PT-02b. the [Assignment: organization-defined processing] of personally identifiable information is restricted to only that which is authorized.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-2 > PT-2(1) > Assessment Methods

PT-2(1) Data Tagging - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures including procedures addressing data tagging

data tag definitions

documented requirements for use and monitoring of data tagging

data extracts with corresponding data tags

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for authorizing the processing of personally identifiable information

organizational processes for data tagging

mechanisms for applying and monitoring data tagging

mechanisms supporting and/or implementing the restriction of personally identifiable information processing
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-2 > PT-2(1) > Assessment Objective

PT-2(1) Data Tagging - Assessment Objective
Determine if the following are satisfied:

data tags containing [Assignment: organization-defined authorized processing] are attached to [Assignment: organization-defined elements of personally identifiable information].
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-2 > PT-2(2) > Assessment Methods

PT-2(2) Automation - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for authorizing the processing of personally identifiable information

automated mechanisms supporting and/or implementing the management of authorized personally identifiable information processing
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-2 > PT-2(2) > Assessment Objective

PT-2(2) Automation - Assessment Objective
Determine if the following are satisfied:

enforcement of the authorized processing of personally identifiable information is managed using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-3 > Assessment Methods

PT-3 Personally Identifiable Information Processing Purposes - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

configuration management plan

organizational privacy notices

organizational policies

Privacy Act statements

computer matching notices

applicable Federal Register notices

documented requirements for enforcing and monitoring the processing of personally identifiable information

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for authorizing the processing of personally identifiable information

mechanisms supporting and/or implementing the management of authorized personally identifiable information processing

organizational processes for monitoring changes in processing personally identifiable information
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-3 > Assessment Objective

PT-3 Personally Identifiable Information Processing Purposes - Assessment Objective
Determine if the following are satisfied:

PT-03a. the [Assignment: organization-defined purpose(s)] for processing personally identifiable information is/are identified and documented;
PT-03b.[01] the purpose(s) is/are described in the public privacy notices of the organization;
PT-03b.[02] the purpose(s) is/are described in the policies of the organization;
PT-03c. the [Assignment: organization-defined processing] of personally identifiable information are restricted to only that which is compatible with the identified purpose(s);
PT-03d.[01] changes in the processing of personally identifiable information are monitored;
PT-03d.[02] [Assignment: organization-defined mechanisms] are implemented to ensure that any changes are made in accordance with [Assignment: organization-defined requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-3 > PT-3(1) > Assessment Methods

PT-3(1) Data Tagging - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

documented description of how data tags are used to identify personally identifiable information data elements and their authorized uses

data tag schema

data extracts with corresponding data tags

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with data tagging responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for authorizing the processing of personally identifiable information

mechanisms supporting and/or implementing data tagging
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-3 > PT-3(1) > Assessment Objective

PT-3(1) Data Tagging - Assessment Objective
Determine if the following are satisfied:

data tags containing [Assignment: organization-defined processing purposes] are attached to [Assignment: organization-defined elements of personally identifiable information].
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-3 > PT-3(2) > Assessment Methods

PT-3(2) Automation - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

data extracts with corresponding data tags

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for managing the enforcement of authorized processing of personally identifiable information

automated tracking mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-3 > PT-3(2) > Assessment Objective

PT-3(2) Automation - Assessment Objective
Determine if the following are satisfied:

the processing purposes of personally identifiable information are tracked using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > Assessment Methods

PT-4 Consent - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

consent policies and procedures

consent tools and mechanisms

consent presentation or display (user interface)

evidence of individuals' consent

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for the collection of personally identifiable information

consent tools or mechanisms for users to authorize the processing of their personally identifiable information

mechanisms implementing consent
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > Assessment Objective

PT-4 Consent - Assessment Objective
Determine if the following are satisfied:

the [Assignment: organization-defined tools or mechanisms] are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > PT-4(1) > Assessment Methods

PT-4(1) Tailored Consent - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

consent policies and procedures

consent tools and mechanisms

consent presentation or display (user interface)

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with user interface or user experience responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for consenting to the processing of personally identifiable information

consent tools or mechanisms

mechanisms implementing consent
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > PT-4(1) > Assessment Objective

PT-4(1) Tailored Consent - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined mechanisms] are provided to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > PT-4(2) > Assessment Methods

PT-4(2) Just-in-time Consent - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

consent policies and procedures

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with user interface or user experience responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for the collection of personally identifiable information

mechanisms for obtaining just-in-time consent from users for the processing of their personally identifiable information

mechanisms implementing just-in-time consent
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > PT-4(2) > Assessment Objective

PT-4(2) Just-in-time Consent - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined consent mechanisms] are presented to individuals [Assignment: organization-defined frequency] and in conjunction with [Assignment: organization-defined personally identifiable information processing].
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > PT-4(3) > Assessment Methods

PT-4(3) Revocation - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

consent revocation policies and procedures

consent revocation user interface or user experience

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with user interface or user experience responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for consenting to the processing of personally identifiable information

tools or mechanisms for implementing consent revocation
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-4 > PT-4(3) > Assessment Objective

PT-4(3) Revocation - Assessment Objective
Determine if the following are satisfied:

the [Assignment: organization-defined tools or mechanisms] are implemented for individuals to revoke consent to the processing of their personally identifiable information.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-5 > Assessment Methods

PT-5 Privacy Notice - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act statements

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with user interface or user experience responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-5 > Assessment Objective

PT-5 Privacy Notice - Assessment Objective
Determine if the following are satisfied:

PT-05a.[01] a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization;
PT-05a.[02] a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [Assignment: organization-defined frequency];
PT-05b. a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language;
PT-05c. a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided;
PT-05d. a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided;
PT-05e. a notice to individuals about the processing of personally identifiable information which includes [Assignment: organization-defined information] is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-5 > PT-5(1) > Assessment Methods

PT-5(1) Just-in-time Notice - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with user interface or user experience responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-5 > PT-5(1) > Assessment Objective

PT-5(1) Just-in-time Notice - Assessment Objective
Determine if the following are satisfied:

a notice of personally identifiable information processing is presented to individuals at a time and location where the individual provides personally identifiable information, in conjunction with a data action, or [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-5 > PT-5(2) > Assessment Methods

PT-5(2) Privacy Act Statements - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

forms that include Privacy Act statements

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for including Privacy Act statements on forms that collect information or on separate forms that can be retained by individuals
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-5 > PT-5(2) > Assessment Objective

PT-5(2) Privacy Act Statements - Assessment Objective
Determine if the following are satisfied:

Privacy Act statements are included on forms that collect information that will be maintained in a Privacy Act system of records, or Privacy Act statements are provided on separate forms that can be retained by individuals.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-6 > Assessment Methods

PT-6 System of Records Notice - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

Federal Register notices

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for Privacy Act system of records maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-6 > Assessment Objective

PT-6 System of Records Notice - Assessment Objective
Determine if the following are satisfied:

PT-06a.[01] system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records;
PT-06a.[02] new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records;
PT-06b. system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records;
PT-06c. system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-6 > PT-6(1) > Assessment Methods

PT-6(1) Routine Uses - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for reviewing system of records notices
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-6 > PT-6(1) > Assessment Objective

PT-6(1) Routine Uses - Assessment Objective
Determine if the following are satisfied:

all routine uses published in the system of records notice are reviewed [Assignment: organization-defined frequency] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-6 > PT-6(2) > Assessment Methods

PT-6(2) Exemption Rules - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

Privacy Act exemptions

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for Privacy Act system of records maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-6 > PT-6(2) > Assessment Objective

PT-6(2) Exemption Rules - Assessment Objective
Determine if the following are satisfied:

PT-06(02)[01] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: organization-defined frequency] to ensure that they remain appropriate and necessary in accordance with law;
PT-06(02)[02] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: organization-defined frequency] to ensure that they have been promulgated as regulations;
PT-06(02)[03] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: organization-defined frequency] to ensure that they are accurately described in the system of records notice.