ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(4) > Assessment Methods

SI-18(4) Individual Requests - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

system configuration

individual requests

records of correction or deletion actions performed

system audit records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for responding to individual requests for personally identifiable information correction or deletion

organizational personnel with information security and privacy responsibilities

Test: Request mechanisms

automated mechanisms supporting and/or implementing individual requests for correction or deletion
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(4) > Assessment Objective

SI-18(4) Individual Requests - Assessment Objective
Determine if the following are satisfied:

personally identifiable information is corrected or deleted upon request by individuals or their designated representatives.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(5) > Assessment Methods

SI-18(5) Notice of Correction or Deletion - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

system configuration

individual requests for corrections or deletions

notifications of correction or deletion action

system audit records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for sending correction or deletion notices

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for notifications of correction or deletion

automated mechanisms supporting and/or implementing notifications of correction or deletion
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(5) > Assessment Objective

SI-18(5) Notice of Correction or Deletion - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined recipients] and individuals are notified when the personally identifiable information has been corrected or deleted.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > Assessment Methods

SI-19 De-identification - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

system configuration

datasets with personally identifiable information removed

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for identifying unnecessary identifiers

organizational personnel responsible for removing personally identifiable information from datasets

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > Assessment Objective

SI-19 De-identification - Assessment Objective
Determine if the following are satisfied:

SI-19a. [Assignment: organization-defined elements] are removed from datasets;
SI-19b. the effectiveness of de-identification is evaluated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(1) > Assessment Methods

SI-19(1) Collection - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

procedures for minimizing the collection of personally identifiable information

system configuration

data collection mechanisms

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms preventing the collection of personally identifiable information
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(1) > Assessment Objective

SI-19(1) Collection - Assessment Objective
Determine if the following are satisfied:

the dataset is de-identified upon collection by not collecting personally identifiable information.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(2) > Assessment Methods

SI-19(2) Archiving - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

system configuration documentation

data archiving mechanisms

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with dataset archival responsibilities

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms prohibiting the archival of personally identifiable information elements
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(2) > Assessment Objective

SI-19(2) Archiving - Assessment Objective
Determine if the following are satisfied:

the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(3) > Assessment Methods

SI-19(3) Release - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

procedures for minimizing the release of personally identifiable information

system configuration

data release mechanisms

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements from a dataset
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(3) > Assessment Objective

SI-19(3) Release - Assessment Objective
Determine if the following are satisfied:

personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(4) > Assessment Methods

SI-19(4) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

system configuration

documentation of de-identified datasets

tools for the removal, masking, encryption, hashing or replacement of direct identifiers

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms supporting and/or implementing the removal, masking, encryption, hashing or replacement of direct identifiers
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(4) > Assessment Objective

SI-19(4) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers - Assessment Objective
Determine if the following are satisfied:

direct identifiers in a dataset are removed, masked, encrypted, hashed, or replaced.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(5) > Assessment Methods

SI-19(5) Statistical Disclosure Control - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

system configuration

de-identified datasets

statistical analysis report

tools for the control of statistical disclosure

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms supporting and/or implementing the control of statistical disclosure
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(5) > Assessment Objective

SI-19(5) Statistical Disclosure Control - Assessment Objective
Determine if the following are satisfied:

SI-19(05)[01] numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis;
SI-19(05)[02] contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis;
SI-19(05)[03] statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(6) > Assessment Methods

SI-19(6) Differential Privacy - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

system configuration

de-identified datasets

differential privacy tools

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Test: Online query systems

automated mechanisms supporting and/or implementing differential privacy
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(6) > Assessment Objective

SI-19(6) Differential Privacy - Assessment Objective
Determine if the following are satisfied:

the disclosure of personally identifiable information is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(7) > Assessment Methods

SI-19(7) Validated Algorithms and Software - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

system configuration

de-identified datasets

algorithm and software validation tools

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Test: Validated algorithms and software
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(7) > Assessment Objective

SI-19(7) Validated Algorithms and Software - Assessment Objective
Determine if the following are satisfied:

SI-19(07)[01] de-identification is performed using validated algorithms;
SI-19(07)[02] de-identification is performed using software that is validated to implement the algorithms.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(8) > Assessment Methods

SI-19(8) Motivated Intruder - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

system configuration

motivated intruder test procedures

de-identified datasets

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Test: Motivated intruder test
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-19 > SI-19(8) > Assessment Objective

SI-19(8) Motivated Intruder - Assessment Objective
Determine if the following are satisfied:

a motivated intruder test is performed on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-20 > Assessment Methods

SI-20 Tainting - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

procedures addressing software and information integrity

system design documentation

system configuration settings and associated documentation

policy and procedures addressing the systems security engineering technique of deception

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel responsible for detecting tainted data

organizational personnel with systems security engineering responsibilities

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms for post-breach detection

decoys, traps, lures, and methods for deceiving adversaries

detection and notification mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-20 > Assessment Objective

SI-20 Tainting - Assessment Objective
Determine if the following are satisfied:

data or capabilities are embedded in [Assignment: organization-defined systems or system components] to determine if organizational data has been exfiltrated or improperly removed from the organization.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-21 > Assessment Methods

SI-21 Information Refresh - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

procedures addressing software and information integrity

system design documentation

system configuration settings and associated documentation

information refresh procedures

list of information to be refreshed

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel responsible for refreshing information

organizational personnel with information security and privacy responsibilities

organizational personnel with systems security engineering responsibilities

system developers

Test: Mechanisms for information refresh

organizational processes for information refresh
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-21 > Assessment Objective

SI-21 Information Refresh - Assessment Objective
Determine if the following are satisfied:

the [Assignment: organization-defined information] is refreshed [Assignment: organization-defined frequencies] or is generated on demand and deleted when no longer needed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-22 > Assessment Methods

SI-22 Information Diversity - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

system design documentation

system configuration settings and associated documentation

list of information sources

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

organizational personnel with systems security engineering responsibilities

system developers

Test: Automated methods and mechanisms to convert information from an analog to digital medium
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-22 > Assessment Objective

SI-22 Information Diversity - Assessment Objective
Determine if the following are satisfied:

SI-22a. [Assignment: organization-defined alternative information sources] for [Assignment: organization-defined essential functions and services] are identified;
SI-22b. an alternative information source is used for the execution of essential functions or services on [Assignment: organization-defined systems or system components] when the primary source of information is corrupted or unavailable.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-23 > Assessment Methods

SI-23 Information Fragmentation - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

procedures addressing software and information integrity

system design documentation

system configuration settings and associated documentation

procedures to identify information for fragmentation and distribution across systems/system components

list of distributed and fragmented information

list of circumstances requiring information fragmentation

enterprise architecture

system security architecture

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

organizational personnel with systems security engineering responsibilities

system developers

security architects

Test: Organizational processes to identify information for fragmentation and distribution across systems/system components

automated mechanisms supporting and/or implementing information fragmentation and distribution across systems/system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-23 > Assessment Objective

SI-23 Information Fragmentation - Assessment Objective
Determine if the following are satisfied:

SI-23a. under [Assignment: organization-defined circumstances], [Assignment: organization-defined information] is fragmented;
SI-23b. under [Assignment: organization-defined circumstances] , the fragmented information is distributed across [Assignment: organization-defined systems or system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-1 > Assessment Methods

SR-1 Policy and Procedures - Assessment Methods and Objects

Examine: Supply chain risk management policy

supply chain risk management procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with supply chain risk management responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with acquisition responsibilities

organizational personnel with enterprise risk management responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SR > SR-1 > Assessment Objective

SR-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

SR-01a.[01] a supply chain risk management policy is developed and documented;
SR-01a.[02] the supply chain risk management policy is disseminated to [Assignment: organization-defined personnel or roles];
SR-01a.[03] supply chain risk management procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls are developed and documented;
SR-01a.[04] the supply chain risk management procedures are disseminated to [Assignment: organization-defined personnel or roles].
SR-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy addresses purpose;
SR-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy addresses scope;
SR-01a.01(a)[03] [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy addresses roles;
SR-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy addresses responsibilities;
SR-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy addresses management commitment;
SR-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy addresses coordination among organizational entities;
SR-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy addresses compliance.
SR-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] supply chain risk management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
SR-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures;
SR-01c.01[01] the current supply chain risk management policy is reviewed and updated [Assignment: organization-defined frequency];
SR-01c.01[02] the current supply chain risk management policy is reviewed and updated following [Assignment: organization-defined events];
SR-01c.02[01] the current supply chain risk management procedures are reviewed and updated [Assignment: organization-defined frequency];
SR-01c.02[02] the current supply chain risk management procedures are reviewed and updated following [Assignment: organization-defined events].