ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-2 > MA-2(2) > Assessment Objective

MA-2(2) Automated Maintenance Activities - Assessment Objective
Determine if the following are satisfied:

MA-02(02)(a)[01] [Assignment: organization-defined automated mechanisms] are used to schedule maintenance, repair, and replacement actions for the system;
MA-02(02)(a)[02] [Assignment: organization-defined automated mechanisms] are used to conduct maintenance, repair, and replacement actions for the system;
MA-02(02)(a)[03] [Assignment: organization-defined automated mechanisms] are used to document maintenance, repair, and replacement actions for the system;
MA-02(02)(b)[01] up-to date, accurate, and complete records of all maintenance actions requested, scheduled, in process, and completed are produced.
MA-02(02)(b)[02] up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed are produced.
MA-02(02)(b)[03] up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed are produced.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > Assessment Methods

MA-3 Maintenance Tools - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance tools

system maintenance tools and associated documentation

maintenance records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for approving, controlling, and monitoring maintenance tools

mechanisms supporting and/or implementing the approval, control, and/or monitoring of maintenance tools
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > Assessment Objective

MA-3 Maintenance Tools - Assessment Objective
Determine if the following are satisfied:

MA-03a.[01] the use of system maintenance tools is approved;
MA-03a.[02] the use of system maintenance tools is controlled;
MA-03a.[03] the use of system maintenance tools is monitored;
MA-03b. previously approved system maintenance tools are reviewed [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(1) > Assessment Methods

MA-3(1) Inspect Tools - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance tools

system maintenance tools and associated documentation

maintenance tool inspection records

maintenance records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for inspecting maintenance tools

mechanisms supporting and/or implementing the inspection of maintenance tools
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(1) > Assessment Objective

MA-3(1) Inspect Tools - Assessment Objective
Determine if the following are satisfied:

maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(2) > Assessment Methods

MA-3(2) Inspect Media - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance tools

system maintenance tools and associated documentation

maintenance records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

Test: Organizational process for inspecting media for malicious code

mechanisms supporting and/or implementing the inspection of media used for maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(2) > Assessment Objective

MA-3(2) Inspect Media - Assessment Objective
Determine if the following are satisfied:

media containing diagnostic and test programs are checked for malicious code before the media are used in the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(3) > Assessment Methods

MA-3(3) Prevent Unauthorized Removal - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance tools

system maintenance tools and associated documentation

maintenance records

equipment sanitization records

media sanitization records

exemptions for equipment removal

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

organizational personnel responsible for media sanitization

Test: Organizational process for preventing unauthorized removal of information

mechanisms supporting media sanitization or destruction of equipment

mechanisms supporting verification of media sanitization
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(3) > Assessment Objective

MA-3(3) Prevent Unauthorized Removal - Assessment Objective
Determine if the following are satisfied:

MA-03(03)(a) the removal of maintenance equipment containing organizational information is prevented by verifying that there is no organizational information contained on the equipment; or
MA-03(03)(b) the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment; or
MA-03(03)(c) the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility; or
MA-03(03)(d) the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(4) > Assessment Methods

MA-3(4) Restricted Tool Use - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance tools

system maintenance tools and associated documentation

list of personnel authorized to use maintenance tools

maintenance tool usage records

maintenance records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for restricting the use of maintenance tools

mechanisms supporting and/or implementing the restricted use of maintenance tools
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(4) > Assessment Objective

MA-3(4) Restricted Tool Use - Assessment Objective
Determine if the following are satisfied:

the use of maintenance tools is restricted to authorized personnel only.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(5) > Assessment Methods

MA-3(5) Execution with Privilege - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance tools

system maintenance tools and associated documentation

list of personnel authorized to use maintenance tools

maintenance tool usage records

maintenance records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for restricting the use of maintenance tools

organizational process for monitoring maintenance tools and maintenance tool usage

mechanisms monitoring the use of maintenance tools
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(5) > Assessment Objective

MA-3(5) Execution with Privilege - Assessment Objective
Determine if the following are satisfied:

the use of maintenance tools that execute with increased privilege is monitored.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(6) > Assessment Methods

MA-3(6) Software Updates and Patches - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance tools

system maintenance tools and associated documentation

list of personnel authorized to use maintenance tools

maintenance tool usage records

maintenance records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for inspecting maintenance tools

organizational processes for maintenance tools updates

mechanisms supporting and/or implementing the inspection of maintenance tools

mechanisms supporting and/or implementing maintenance tool updates.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-3 > MA-3(6) > Assessment Objective

MA-3(6) Software Updates and Patches - Assessment Objective
Determine if the following are satisfied:

maintenance tools are inspected to ensure that the latest software updates and patches are installed.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > Assessment Methods

MA-4 Nonlocal Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing nonlocal system maintenance

remote access policy

remote access procedures

system design documentation

system configuration settings and associated documentation

maintenance records

records of remote access

diagnostic records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing nonlocal maintenance

mechanisms implementing, supporting, and/or managing nonlocal maintenance

mechanisms for strong authentication of nonlocal maintenance diagnostic sessions

mechanisms for terminating nonlocal maintenance sessions and network connections
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > Assessment Objective

MA-4 Nonlocal Maintenance - Assessment Objective
Determine if the following are satisfied:

MA-04a.[01] nonlocal maintenance and diagnostic activities are approved;
MA-04a.[02] nonlocal maintenance and diagnostic activities are monitored;
MA-04b.[01] the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy;
MA-04b.[02] the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system;
MA-04c. strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions;
MA-04d. records for nonlocal maintenance and diagnostic activities are maintained;
MA-04e.[01] session connections are terminated when nonlocal maintenance is completed;
MA-04e.[02] network connections are terminated when nonlocal maintenance is completed.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(1) > Assessment Methods

MA-4(1) Logging and Review - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing nonlocal system maintenance

list of audit events

system configuration settings and associated documentation

maintenance records

diagnostic records

audit records

reviews of maintenance and diagnostic session records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

organizational personnel with audit and review responsibilities

system/network administrators

Test: Organizational processes for audit and review of nonlocal maintenance

mechanisms supporting and/or implementing audit and review of nonlocal maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(1) > Assessment Objective

MA-4(1) Logging and Review - Assessment Objective
Determine if the following are satisfied:

MA-04(01)(a)[01] [Assignment: organization-defined audit events] are logged for nonlocal maintenance sessions;
MA-04(01)(a)[02] [Assignment: organization-defined audit events] are logged for nonlocal diagnostic sessions;
MA-04(01)(b)[01] the audit records of the maintenance sessions are reviewed to detect anomalous behavior;
MA-04(01)(b)[02] the audit records of the diagnostic sessions are reviewed to detect anomalous behavior.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(3) > Assessment Methods

MA-4(3) Comparable Security and Sanitization - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing nonlocal system maintenance

service provider contracts and/or service-level agreements

maintenance records

inspection records

audit records

equipment sanitization records

media sanitization records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

system maintenance provider

organizational personnel with information security responsibilities

organizational personnel responsible for media sanitization

system/network administrators

Test: Organizational processes for comparable security and sanitization for nonlocal maintenance

organizational processes for the removal, sanitization, and inspection of components serviced via nonlocal maintenance

mechanisms supporting and/or implementing component sanitization and inspection
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(3) > Assessment Objective

MA-4(3) Comparable Security and Sanitization - Assessment Objective
Determine if the following are satisfied:

MA-04(03)(a)[01] nonlocal maintenance services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced;
MA-04(03)(a)[02] nonlocal diagnostic services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or
MA-04(03)(b)[01] the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services;
MA-04(03)(b)[02] the component to be serviced is sanitized (for organizational information);
MA-04(03)(b)[03] the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(4) > Assessment Methods

MA-4(4) Authentication and Separation of Maintenance Sessions - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing nonlocal system maintenance

system design documentation

system configuration settings and associated documentation

maintenance records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

network engineers

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for protecting nonlocal maintenance sessions

mechanisms implementing replay-resistant authenticators

mechanisms implementing logically separated/encrypted communication paths
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(4) > Assessment Objective

MA-4(4) Authentication and Separation of Maintenance Sessions - Assessment Objective
Determine if the following are satisfied:

MA-04(04)(a) nonlocal maintenance sessions are protected by employing [Assignment: organization-defined authenticators that are replay resistant];
MA-04(04)(b)(01) nonlocal maintenance sessions are protected by separating maintenance sessions from other network sessions with the system by physically separated communication paths; or
MA-04(04)(b)(02) nonlocal maintenance sessions are protected by logically separated communication paths.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(5) > Assessment Methods

MA-4(5) Approvals and Notifications - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing nonlocal system maintenance

notifications supporting nonlocal maintenance sessions

maintenance records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with notification responsibilities

organizational personnel with approval responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for approving and notifying personnel regarding nonlocal maintenance

mechanisms supporting the notification and approval of nonlocal maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(5) > Assessment Objective

MA-4(5) Approvals and Notifications - Assessment Objective
Determine if the following are satisfied:

MA-04(05)(a) the approval of each nonlocal maintenance session is required by [Assignment: organization-defined personnel or roles];
MA-04(05)(b) [Assignment: organization-defined personnel and roles] is/are notified of the date and time of planned nonlocal maintenance.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(6) > Assessment Methods

MA-4(6) Cryptographic Protection - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing nonlocal system maintenance

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms protecting nonlocal maintenance activities

maintenance records

diagnostic records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

network engineers

organizational personnel with information security responsibilities

system/network administrators

Test: Cryptographic mechanisms protecting nonlocal maintenance and diagnostic communications
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(6) > Assessment Objective

MA-4(6) Cryptographic Protection - Assessment Objective
Determine if the following are satisfied:

MA-04(06)[01] [Assignment: organization-defined cryptographic mechanisms] are implemented to protect the integrity of nonlocal maintenance and diagnostic communications;
MA-04(06)[02] [Assignment: organization-defined cryptographic mechanisms] are implemented to protect the confidentiality of nonlocal maintenance and diagnostic communications.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(7) > Assessment Methods

MA-4(7) Disconnect Verification - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing nonlocal system maintenance

system design documentation

system configuration settings and associated documentation

session/network termination logs

cryptographic mechanisms protecting nonlocal maintenance activities

maintenance records

diagnostic records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

network engineers

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms implementing remote disconnect verifications of terminated nonlocal maintenance and diagnostic sessions
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-4 > MA-4(7) > Assessment Objective

MA-4(7) Disconnect Verification - Assessment Objective
Determine if the following are satisfied:

MA-04(07)[01] session connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions;
MA-04(07)[02] network connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > Assessment Methods

MA-5 Maintenance Personnel - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing maintenance personnel

service provider contracts

service-level agreements

list of authorized personnel

maintenance records

access control records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for authorizing and managing maintenance personnel

mechanisms supporting and/or implementing authorization of maintenance personnel
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > Assessment Objective

MA-5 Maintenance Personnel - Assessment Objective
Determine if the following are satisfied:

MA-05a.[01] a process for maintenance personnel authorization is established;
MA-05a.[02] a list of authorized maintenance organizations or personnel is maintained;
MA-05b. non-escorted personnel performing maintenance on the system possess the required access authorizations;
MA-05c. organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(1) > Assessment Methods

MA-5(1) Individuals Without Appropriate Access - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing maintenance personnel

system media protection policy

physical and environmental protection policy

list of maintenance personnel requiring escort/supervision

maintenance records

access control records

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with personnel security responsibilities

organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

organizational personnel responsible for media sanitization

system/network administrators

Test: Organizational processes for managing maintenance personnel without appropriate access

mechanisms supporting and/or implementing alternative security safeguards

mechanisms supporting and/or implementing information storage component sanitization