ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(5) > Discussion

SC-42(5) Collection Minimization - Discussion
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

Although policies to control for authorized use can be applied to information once it is collected, minimizing the collection of information that is not needed mitigates privacy risk at the system entry point and mitigates the risk of policy control failures. Sensor configurations include the obscuring of human features, such as blurring or pixelating flesh tones.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(5)

SC-42(5) Sensor Capability and Data | Collection Minimization
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

Employ [Assignment: organization-defined sensors] that are configured to minimize the collection of information about individuals that is not needed.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-43

SC-43 Usage Restrictions
Family: System and Communications Protection (SC)

a. Establish usage restrictions and implementation guidelines for the following system components: [Assignment: organization-defined components] ; and
b. Authorize, monitor, and control the use of such components within the system.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-43 > Discussion

SC-43 Usage Restrictions - Discussion
Family: System and Communications Protection (SC)

Usage restrictions apply to all system components including but not limited to mobile code, mobile devices, wireless access, and wired and wireless peripheral components (e.g., copiers, printers, scanners, optical devices, and other similar technologies). The usage restrictions and implementation guidelines are based on the potential for system components to cause damage to the system and help to ensure that only authorized system use occurs.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-44

SC-44 Detonation Chambers
Family: System and Communications Protection (SC)

Employ a detonation chamber capability within [Assignment: organization-defined system, system component, or location].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-44 > Discussion

SC-44 Detonation Chambers - Discussion
Family: System and Communications Protection (SC)

Detonation chambers, also known as dynamic execution environments, allow organizations to open email attachments, execute untrusted or suspicious applications, and execute Universal Resource Locator requests in the safety of an isolated environment or a virtualized sandbox. Protected and isolated execution environments provide a means of determining whether the associated attachments or applications contain malicious code. While related to the concept of deception nets, the employment of detonation chambers is not intended to maintain a long-term environment in which adversaries can operate and their actions can be observed. Rather, detonation chambers are intended to quickly identify malicious code and either reduce the likelihood that the code is propagated to user environments of operation or prevent such propagation completely.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-45

SC-45 System Time Synchronization
Family: System and Communications Protection (SC)

Synchronize system clocks within and between systems and system components.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-45 > Discussion

SC-45 System Time Synchronization - Discussion
Family: System and Communications Protection (SC)

Time synchronization of system clocks is essential for the correct execution of many system services, including identification and authentication processes that involve certificates and time-of-day restrictions as part of access control. Denial of service or failure to deny expired credentials may result without properly synchronized clocks within and between systems and system components. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. The granularity of time measurements refers to the degree of synchronization between system clocks and reference clocks, such as clocks synchronizing within hundreds of milliseconds or tens of milliseconds. Organizations may define different time granularities for system components. Time service can be critical to other security capabilities-such as access control and identification and authentication-depending on the nature of the mechanisms used to support the capabilities.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-45 > SC-45(1) > Discussion

SC-45(1) Synchronization with Authoritative Time Source - Discussion
Family: System and Communications Protection (SC) > SC-45 System Time Synchronization

Synchronization of internal system clocks with an authoritative source provides uniformity of time stamps for systems with multiple system clocks and systems connected over a network.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-45 > SC-45(1)

SC-45(1) System Time Synchronization | Synchronization with Authoritative Time Source
Family: System and Communications Protection (SC) > SC-45 System Time Synchronization

(a) Compare the internal system clocks [Assignment: organization-defined frequency] with [Assignment: organization-defined authoritative time source] ; and
(b) Synchronize the internal system clocks to the authoritative time source when the time difference is greater than [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-45 > SC-45(2) > Discussion

SC-45(2) Secondary Authoritative Time Source - Discussion
Family: System and Communications Protection (SC) > SC-45 System Time Synchronization

It may be necessary to employ geolocation information to determine that the secondary authoritative time source is in a different geographic region.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-45 > SC-45(2)

SC-45(2) System Time Synchronization | Secondary Authoritative Time Source
Family: System and Communications Protection (SC) > SC-45 System Time Synchronization

(a) Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source; and
(b) Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-46

SC-46 Cross Domain Policy Enforcement
Family: System and Communications Protection (SC)

Implement a policy enforcement mechanism [Selection: physically; logically] between the physical and/or network interfaces for the connecting security domains.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-46 > Discussion

SC-46 Cross Domain Policy Enforcement - Discussion
Family: System and Communications Protection (SC)

For logical policy enforcement mechanisms, organizations avoid creating a logical path between interfaces to prevent the ability to bypass the policy enforcement mechanism. For physical policy enforcement mechanisms, the robustness of physical isolation afforded by the physical implementation of policy enforcement to preclude the presence of logical covert channels penetrating the security domain may be needed. Contact [ncdsmo@nsa.gov](mailto:ncdsmo@nsa.gov) for more information.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-47

SC-47 Alternate Communications Paths
Family: System and Communications Protection (SC)

Establish [Assignment: organization-defined alternate communication paths] for system operations organizational command and control.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-47 > Discussion

SC-47 Alternate Communications Paths - Discussion
Family: System and Communications Protection (SC)

An incident, whether adversarial- or nonadversarial-based, can disrupt established communications paths used for system operations and organizational command and control. Alternate communications paths reduce the risk of all communications paths being affected by the same incident. To compound the problem, the inability of organizational officials to obtain timely information about disruptions or to provide timely direction to operational elements after a communications path incident, can impact the ability of the organization to respond to such incidents in a timely manner. Establishing alternate communications paths for command and control purposes, including designating alternative decision makers if primary decision makers are unavailable and establishing the extent and limitations of their actions, can greatly facilitate the organization's ability to continue to operate and take appropriate actions during an incident.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-48

SC-48 Sensor Relocation
Family: System and Communications Protection (SC)

Relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment: organization-defined conditions or circumstances].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-48 > Discussion

SC-48 Sensor Relocation - Discussion
Family: System and Communications Protection (SC)

Adversaries may take various paths and use different approaches as they move laterally through an organization (including its systems) to reach their target or as they attempt to exfiltrate information from the organization. The organization often only has a limited set of monitoring and detection capabilities, and they may be focused on the critical or likely infiltration or exfiltration paths. By using communications paths that the organization typically does not monitor, the adversary can increase its chances of achieving its desired goals. By relocating its sensors or monitoring capabilities to new locations, the organization can impede the adversary's ability to achieve its goals. The relocation of the sensors or monitoring capabilities might be done based on threat information that the organization has acquired or randomly to confuse the adversary and make its lateral transition through the system or organization more challenging.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-48 > SC-48(1)

SC-48(1) Sensor Relocation | Dynamic Relocation of Sensors or Monitoring Capabilities
Family: System and Communications Protection (SC) > SC-48 Sensor Relocation

Dynamically relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment: organization-defined conditions or circumstances].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-49

SC-49 Hardware-enforced Separation and Policy Enforcement
Family: System and Communications Protection (SC)

Implement hardware-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-49 > Discussion

SC-49 Hardware-enforced Separation and Policy Enforcement - Discussion
Family: System and Communications Protection (SC)

System owners may require additional strength of mechanism and robustness to ensure domain separation and policy enforcement for specific types of threats and environments of operation. Hardware-enforced separation and policy enforcement provide greater strength of mechanism than software-enforced separation and policy enforcement.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-50

SC-50 Software-enforced Separation and Policy Enforcement
Family: System and Communications Protection (SC)

Implement software-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-50 > Discussion

SC-50 Software-enforced Separation and Policy Enforcement - Discussion
Family: System and Communications Protection (SC)

System owners may require additional strength of mechanism to ensure domain separation and policy enforcement for specific types of threats and environments of operation.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-51

SC-51 Hardware-based Protection
Family: System and Communications Protection (SC)

a. Employ hardware-based, write-protect for [Assignment: organization-defined system firmware components] ; and
b. Implement specific procedures for [Assignment: organization-defined authorized individuals] to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-1

SI-1 Policy and Procedures
Family: System and Information Integrity (SI)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and
c. Review and update the current system and information integrity:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-1 > Discussion

SI-1 Policy and Procedures - Discussion
Family: System and Information Integrity (SI)

System and information integrity policy and procedures address the controls in the SI family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of system and information integrity policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to system and information integrity policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2

SI-2 Flaw Remediation
Family: System and Information Integrity (SI)

a. Identify, report, and correct system flaws;
b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and
d. Incorporate flaw remediation into the organizational configuration management process.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > Discussion

SI-2 Flaw Remediation - Discussion
Family: System and Information Integrity (SI)

The need to remediate system flaws applies to all types of software and firmware. Organizations identify systems affected by software flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated organizational personnel with information security and privacy responsibilities. Organizations consider establishing a controlled patching environment for mission-critical systems. Security-relevant updates include patches, service packs, and malicious code signatures. Organizations also address flaws discovered during assessments, continuous monitoring, incident response activities, and system error handling. By incorporating flaw remediation into configuration management processes, required remediation actions can be tracked and verified.

Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of risk factors, including the security category of the system, the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw), the organizational risk tolerance, the mission supported by the system, or the threat environment. Some types of flaw remediation may require more testing than other types. Organizations determine the type of testing needed for the specific type of flaw remediation activity under consideration and the types of changes that are to be configuration-managed. Flaw remediation testing addresses both effectiveness of addressing security issues and for potential side effects on functionality, system and system component performance and operations. When implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). In some situations, organizations may determine that the testing of software or firmware updates is not necessary or practical, such as when implementing simple malicious code signature updates. In testing decisions, organizations consider whether security-relevant software or firmware updates are obtained from authorized sources with appropriate digital signatures.

When implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). Organizations verify that software and firmware updates come from authorized sources prior to downloading.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(2) > Discussion

SI-2(2) Automated Flaw Remediation Status - Discussion
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Automated mechanisms can track and determine the status of known flaws for system components.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(2)

SI-2(2) Flaw Remediation | Automated Flaw Remediation Status
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(3) > Discussion

SI-2(3) Time to Remediate Flaws and Benchmarks for Corrective Actions - Discussion
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Organizations determine the time it takes on average to correct system flaws after such flaws have been identified and subsequently establish organizational benchmarks (i.e., time frames) for taking corrective actions. Benchmarks can be established by the type of flaw or the severity of the potential vulnerability if the flaw can be exploited.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(3)

SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

(a) Measure the time between flaw identification and flaw remediation; and
(b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined benchmarks].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(4) > Discussion

SI-2(4) Automated Patch Management Tools - Discussion
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Using automated tools to support patch management helps to ensure the timeliness and completeness of system patching operations.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(4)

SI-2(4) Flaw Remediation | Automated Patch Management Tools
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Employ automated patch management tools to facilitate flaw remediation to the following system components: [Assignment: organization-defined components].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(5) > Discussion

SI-2(5) Automatic Software and Firmware Updates - Discussion
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Due to system integrity and availability concerns, organizations consider the methodology used to carry out automatic updates. Organizations balance the need to ensure that the updates are installed as soon as possible with the need to maintain configuration management and control with any mission or operational impacts that automatic updates might impose (i.e., implementing a staggered deployment strategy).
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(5)

SI-2(5) Flaw Remediation | Automatic Software and Firmware Updates
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(6) > Discussion

SI-2(6) Removal of Previous Versions of Software and Firmware - Discussion
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Previous versions of software or firmware components that are not removed from the system after updates have been installed may be exploited by adversaries. Some products may automatically remove previous versions of software and firmware from the system.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(6)

SI-2(6) Flaw Remediation | Removal of Previous Versions of Software and Firmware
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Remove previous versions of [Assignment: organization-defined software and firmware components] after updated versions have been installed.