ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > Assessment Objective

SA-17 Developer Security and Privacy Architecture and Design - Assessment Objective
Determine if the following are satisfied:

SA-17(a)[01] the developer of the system, system component, or system service is required to produce a design specification and security architecture that are consistent with the organization's security architecture, which is an integral part the organization's enterprise architecture;
SA-17(a)[02] the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that are consistent with the organization's privacy architecture, which is an integral part the organization's enterprise architecture;
SA-17(b)[01] the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components;
SA-17(b)[02] the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components;
SA-17(c)[01] the developer of the system, system component, or system service is required to produce a design specification and security architecture that express how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection;
SA-17(c)[02] the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that express how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(1) > Assessment Methods

SA-17(1) Formal Policy Model - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

enterprise architecture policy

enterprise architecture documentation

procedures addressing developer security and privacy architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system design documentation

system configuration settings and associated documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(1) > Assessment Objective

SA-17(1) Formal Policy Model - Assessment Objective
Determine if the following are satisfied:

SA-17(01)(a)[01] as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [Assignment: organization-defined organizational security policy] to be enforced;
SA-17(01)(a)[02] as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [Assignment: organization-defined organizational privacy policy] to be enforced;
SA-17(01)(b)[01] the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented;
SA-17(01)(b)[02] the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(2) > Assessment Methods

SA-17(2) Security-relevant Components - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

procedures addressing developer security architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

list of security-relevant hardware, software, and firmware components

documented rationale of completeness regarding definitions provided for security-relevant hardware, software, and firmware

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developers

organizational personnel with information security architecture and design responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(2) > Assessment Objective

SA-17(2) Security-relevant Components - Assessment Objective
Determine if the following are satisfied:

SA-17(02)(a)[01] the developer of the system, system component, or system service is required to define security-relevant hardware;
SA-17(02)(a)[02] the developer of the system, system component, or system service is required to define security-relevant software;
SA-17(02)(a)[03] the developer of the system, system component, or system service is required to define security-relevant firmware;
SA-17(02)(b) the developer of the system, system component, or system service is required to provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(3) > Assessment Methods

SA-17(3) Formal Correspondence - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

formal policy model

procedures addressing developer security architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

formal top-level specification documentation

system security architecture and design documentation

system design documentation

system configuration settings and associated documentation

documentation describing security-relevant hardware, software, and firmware mechanisms not addressed in the formal top-level specification documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with information security architecture and design responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(3) > Assessment Objective

SA-17(3) Formal Correspondence - Assessment Objective
Determine if the following are satisfied:

SA-17(03)(a)[01] as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions;
SA-17(03)(a)[02] as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages;
SA-17(03)(a)[03] as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects;
SA-17(03)(b) the developer of the system, system component, or system service is required to show proof that the formal top-level specification is consistent with the formal policy model to the extent feasible with additional informal demonstration as necessary;
SA-17(03)(c) the developer of the system, system component, or system service is required to show via informal demonstration that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;
SA-17(03)(d) the developer of the system, system component, or system service is required to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware;
SA-17(03)(e) the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the formal top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(4) > Assessment Methods

SA-17(4) Informal Correspondence - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

formal policy model

procedures addressing developer security architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

informal, descriptive top-level specification documentation

system security architecture and design documentation

system design documentation

system configuration settings and associated documentation

documentation describing security-relevant hardware, software, and firmware mechanisms not addressed in the informal, descriptive top-level specification documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with information security architecture and design responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(4) > Assessment Objective

SA-17(4) Informal Correspondence - Assessment Objective
Determine if the following are satisfied:

SA-17(04)(a)[01] as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions;
SA-17(04)(a)[02] as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages;
SA-17(04)(a)[03] as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects;
SA-17(04)(b) the developer of the system, system component, or system service is required to show via [Selection: informal demonstration, convincing argument with formal methods as feasible] that the descriptive top-level specification is consistent with the formal policy model;
SA-17(04)(c) the developer of the system, system component, or system service is required to show via informal demonstration that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;
SA-17(04)(d) the developer of the system, system component, or system service is required to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware;
SA-17(04)(e) the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the descriptive top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(5) > Assessment Methods

SA-17(5) Conceptually Simple Design - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

procedures addressing developer security architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system design documentation

system security architecture documentation

system configuration settings and associated documentation

developer documentation describing the design and structure of security-relevant hardware, software, and firmware components

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with information security architecture and design responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(5) > Assessment Objective

SA-17(5) Conceptually Simple Design - Assessment Objective
Determine if the following are satisfied:

SA-17(05)(a) the developer of the system, system component, or system service is required to design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics;
SA-17(05)(b) the developer of the system, system component, or system service is required to internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(6) > Assessment Methods

SA-17(6) Structure for Testing - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

procedures addressing developer security architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system design documentation

system security architecture documentation

privacy architecture documentation

system configuration settings and associated documentation

developer documentation describing the design and structure of security-relevant hardware, software, and firmware components to facilitate testing

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer

organizational personnel with information security and privacy architecture and design responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(6) > Assessment Objective

SA-17(6) Structure for Testing - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate testing.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(7) > Assessment Methods

SA-17(7) Structure for Least Privilege - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

procedures addressing developer security architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system design documentation

system security architecture documentation

system configuration settings and associated documentation

developer documentation describing the design and structure of security-relevant hardware, software, and firmware components to facilitate controlling access with least privilege

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with information security architecture and design responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(7) > Assessment Objective

SA-17(7) Structure for Least Privilege - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(8) > Assessment Methods

SA-17(8) Orchestration - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

procedures addressing developer security and privacy architecture and design

enterprise architecture

security architecture

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system design documentation

system configuration settings and associated documentation

developer documentation describing design orchestration

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer

organizational personnel with information security architecture responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(8) > Assessment Objective

SA-17(8) Orchestration - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined critical systems] are designed with coordinated behavior to implement [Assignment: organization-defined capabilities].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(9) > Assessment Methods

SA-17(9) Design Diversity - Assessment Methods and Objects

Examine: System and services acquisition policy

enterprise architecture policy

procedures addressing developer security architecture and design diversity for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system design documentation

system security architecture documentation

system configuration settings and associated documentation

developer documentation describing design diversity

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with information security architecture responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > SA-17(9) > Assessment Objective

SA-17(9) Design Diversity - Assessment Objective
Determine if the following are satisfied:

different designs are used for [Assignment: organization-defined critical systems] to satisfy a common set of requirements or to provide equivalent functionality.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-20 > Assessment Methods

SA-20 Customized Development of Critical Components - Assessment Methods and Objects

Examine: Supply chain risk management plan

system and services acquisition policy

procedures addressing the customized development of critical system components

system design documentation

system configuration settings and associated documentation

system development life cycle documentation addressing the custom development of critical system components

configuration management records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with responsibility for the reimplementation or customized development of critical system components

Test: Organizational processes for the reimplementation or customized development of critical system components

mechanisms supporting and/or implementing the reimplementation or customized development of critical system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-20 > Assessment Objective

SA-20 Customized Development of Critical Components - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined critical system] are reimplemented or custom-developed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-21 > Assessment Methods

SA-21 Developer Screening - Assessment Methods and Objects

Examine: System and services acquisition policy

personnel security policy and procedures

procedures addressing personnel screening

system design documentation

acquisition documentation

service level agreements

acquisition contracts for developer services

system configuration settings and associated documentation

list of appropriate access authorizations required by the developers of the system

personnel screening criteria and associated documentation

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel responsible for developer screening

Test: Organizational processes for developer screening

mechanisms supporting developer screening
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-21 > Assessment Objective

SA-21 Developer Screening - Assessment Objective
Determine if the following are satisfied:

SA-21a. the developer of [Assignment: organization-defined system, systems component, or system service] is required to have appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties];
SA-21b. the developer of [Assignment: organization-defined system, systems component, or system service] is required to satisfy [Assignment: organization-defined additional personnel screening criteria].