ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > PE-2(1) > Assessment Methods

PE-2(1) Access by Position or Role - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access authorizations

physical access control logs or records

list of positions/roles and corresponding physical access authorizations

system entry and exit points

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access authorization responsibilities

organizational personnel with physical access to system facility

organizational personnel with information security responsibilities

Test: Organizational processes for physical access authorizations

mechanisms supporting and/or implementing physical access authorizations
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > PE-2(1) > Assessment Objective

PE-2(1) Access by Position or Role - Assessment Objective
Determine if the following are satisfied:

physical access to the facility where the system resides is authorized based on position or role.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > PE-2(2) > Assessment Methods

PE-2(2) Two Forms of Identification - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access authorizations

list of acceptable forms of identification for visitor access to the facility where the system resides

access authorization forms

access credentials

physical access control logs or records

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access authorization responsibilities

organizational personnel with physical access to the system facility

organizational personnel with information security responsibilities

Test: Organizational processes for physical access authorizations

mechanisms supporting and/or implementing physical access authorizations
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > PE-2(2) > Assessment Objective

PE-2(2) Two Forms of Identification - Assessment Objective
Determine if the following are satisfied:

two forms of identification are required from [Assignment: organization-defined list of acceptable forms of identification] for visitor access to the facility where the system resides.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > PE-2(3) > Assessment Methods

PE-2(3) Restrict Unescorted Access - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access authorizations

authorized personnel access list

security clearances

access authorizations

access credentials

physical access control logs or records

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access authorization responsibilities

organizational personnel with physical access to the system facility

organizational personnel with information security responsibilities

Test: Organizational processes for physical access authorizations

mechanisms supporting and/or implementing physical access authorizations
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > PE-2(3) > Assessment Objective

PE-2(3) Restrict Unescorted Access - Assessment Objective
Determine if the following are satisfied:

unescorted access to the facility where the system resides is restricted to personnel with [Selection; one or more: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; [Assignment: organization-defined physical access authorizations] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > Assessment Methods

PE-3 Physical Access Control - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

physical access control logs or records

inventory records of physical access control devices

system entry and exit points

records of key and lock combination changes

storage locations for physical access control devices

physical access control devices

list of security safeguards controlling access to designated publicly accessible areas within facility

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for physical access control

mechanisms supporting and/or implementing physical access control

physical access control devices
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > Assessment Objective

PE-3 Physical Access Control - Assessment Objective
Determine if the following are satisfied:

PE-03a.01 physical access authorizations are enforced at [Assignment: organization-defined entry and exit points] by verifying individual access authorizations before granting access to the facility;
PE-03a.02 physical access authorizations are enforced at [Assignment: organization-defined entry and exit points] by controlling ingress and egress to the facility using [Selection; one or more: [Assignment: organization-defined systems or devices] ; guards];
PE-03b. physical access audit logs are maintained for [Assignment: organization-defined entry or exit points];
PE-03c. access to areas within the facility designated as publicly accessible are maintained by implementing [Assignment: organization-defined physical access controls];
PE-03d.[01] visitors are escorted;
PE-03d.[02] visitor activity is controlled [Assignment: organization-defined circumstances];
PE-03e.[01] keys are secured;
PE-03e.[02] combinations are secured;
PE-03e.[03] other physical access devices are secured;
PE-03f. [Assignment: organization-defined physical access devices] are inventoried [Assignment: organization-defined frequency];
PE-03g.[01] combinations are changed [Assignment: organization-defined frequency] , when combinations are compromised, or when individuals possessing the combinations are transferred or terminated;
PE-03g.[02] keys are changed [Assignment: organization-defined frequency] , when keys are lost, or when individuals possessing the keys are transferred or terminated.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(1) > Assessment Methods

PE-3(1) System Access - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

physical access control logs or records

physical access control devices

access authorizations

access credentials

system entry and exit points

list of areas within the facility containing concentrations of system components or system components requiring additional physical protection

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access authorization responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for physical access control to the information system/components

mechanisms supporting and/or implementing physical access control for facility areas containing system components
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(1) > Assessment Objective

PE-3(1) System Access - Assessment Objective
Determine if the following are satisfied:

PE-03(01)[01] physical access authorizations to the system are enforced;
PE-03(01)[02] physical access controls are enforced for the facility at [Assignment: organization-defined physical spaces].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(2) > Assessment Methods

PE-3(2) Facility and Systems - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

physical access control logs or records

records of security checks

security audit reports

security inspection reports

facility layout documentation

system entry and exit points

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for physical access control to the facility and/or system

mechanisms supporting and/or implementing physical access control for the facility or system

mechanisms supporting and/or implementing security checks for the unauthorized exfiltration of information
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(2) > Assessment Objective

PE-3(2) Facility and Systems - Assessment Objective
Determine if the following are satisfied:

security checks are performed [Assignment: organization-defined frequency] at the physical perimeter of the facility or system for exfiltration of information or removal of system components.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(3) > Assessment Methods

PE-3(3) Continuous Guards - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

physical access control logs or records

physical access control devices

facility surveillance records

facility layout documentation

system entry and exit points

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for physical access control to the facility where the system resides

mechanisms supporting and/or implementing physical access control for the facility where the system resides
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(3) > Assessment Objective

PE-3(3) Continuous Guards - Assessment Objective
Determine if the following are satisfied:

guards are employed to control [Assignment: organization-defined physical access points] to the facility where the system resides 24 hours per day, 7 days per week.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(4) > Assessment Methods

PE-3(4) Lockable Casings - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

list of system components requiring protection through lockable physical casings

lockable physical casings

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Lockable physical casings
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(4) > Assessment Objective

PE-3(4) Lockable Casings - Assessment Objective
Determine if the following are satisfied:

lockable physical casings are used to protect [Assignment: organization-defined system components] from unauthorized access.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(5) > Assessment Methods

PE-3(5) Tamper Protection - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

list of security safeguards to detect/prevent physical tampering or alteration of system hardware components

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes to detect/prevent physical tampering or alteration of system hardware components

mechanisms/security safeguards supporting and/or implementing the detection/prevention of physical tampering/alternation of system hardware components
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(5) > Assessment Objective

PE-3(5) Tamper Protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined anti-tamper technologies] are employed to [Selection; one or more: detect; prevent] physical tampering or alteration of [Assignment: organization-defined hardware components] within the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(7) > Assessment Methods

PE-3(7) Physical Barriers - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

list of physical barriers to limit access to the system

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(7) > Assessment Objective

PE-3(7) Physical Barriers - Assessment Objective
Determine if the following are satisfied:

physical barriers are used to limit access.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(8) > Assessment Methods

PE-3(8) Access Control Vestibules - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

list of access control vestibules and locations

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for vestibules to prevent unauthorized access.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-3 > PE-3(8) > Assessment Objective

PE-3(8) Access Control Vestibules - Assessment Objective
Determine if the following are satisfied:

access control vestibules are employed at [Assignment: organization-defined locations].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-4 > Assessment Methods

PE-4 Access Control for Transmission - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing access control for transmission mediums

system design documentation

facility communications and wiring diagrams

list of physical security safeguards applied to system distribution and transmission lines

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for access control to distribution and transmission lines

mechanisms/security safeguards supporting and/or implementing access control to distribution and transmission lines
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-4 > Assessment Objective

PE-4 Access Control for Transmission - Assessment Objective
Determine if the following are satisfied:

physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities is controlled using [Assignment: organization-defined security controls].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-5 > Assessment Methods

PE-5 Access Control for Output Devices - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing access control for display medium

facility layout of system components

actual displays from system components

list of output devices and associated outputs requiring physical access controls

physical access control logs or records for areas containing output devices and related outputs

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for access control to output devices

mechanisms supporting and/or implementing access control to output devices
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-5 > Assessment Objective

PE-5 Access Control for Output Devices - Assessment Objective
Determine if the following are satisfied:

physical access to output from [Assignment: organization-defined output devices] is controlled to prevent unauthorized individuals from obtaining the output.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-5 > PE-5(2) > Assessment Methods

PE-5(2) Link to Individual Identity - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access control

system design documentation

system configuration settings and associated documentation

list of output devices and associated outputs requiring physical access controls

physical access control logs or records for areas containing output devices and related outputs

system audit records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with physical access control responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Organizational processes for access control to output devices

mechanisms supporting and/or implementing access control to output devices
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-5 > PE-5(2) > Assessment Objective

PE-5(2) Link to Individual Identity - Assessment Objective
Determine if the following are satisfied:

individual identity is linked to the receipt of output from output devices.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > Assessment Methods

PE-6 Monitoring Physical Access - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access monitoring

physical access logs or records

physical access monitoring records

physical access log reviews

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access monitoring responsibilities

organizational personnel with incident response responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for monitoring physical access

mechanisms supporting and/or implementing physical access monitoring

mechanisms supporting and/or implementing the review of physical access logs
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > Assessment Objective

PE-6 Monitoring Physical Access - Assessment Objective
Determine if the following are satisfied:

PE-06a. physical access to the facility where the system resides is monitored to detect and respond to physical security incidents;
PE-06b.[01] physical access logs are reviewed [Assignment: organization-defined frequency];
PE-06b.[02] physical access logs are reviewed upon occurrence of [Assignment: organization-defined events];
PE-06c.[01] results of reviews are coordinated with organizational incident response capabilities;
PE-06c.[02] results of investigations are coordinated with organizational incident response capabilities.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(1) > Assessment Methods

PE-6(1) Intrusion Alarms and Surveillance Equipment - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access monitoring

physical access logs or records

physical access monitoring records

physical access log reviews

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with physical access monitoring responsibilities

organizational personnel with incident response responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for monitoring physical intrusion alarms and surveillance equipment

mechanisms supporting and/or implementing physical access monitoring

mechanisms supporting and/or implementing physical intrusion alarms and surveillance equipment
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(1) > Assessment Objective

PE-6(1) Intrusion Alarms and Surveillance Equipment - Assessment Objective
Determine if the following are satisfied:

PE-06(01)[01] physical access to the facility where the system resides is monitored using physical intrusion alarms;
PE-06(01)[02] physical access to the facility where the system resides is monitored using physical surveillance equipment.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(2) > Assessment Methods

PE-6(2) Automated Intrusion Recognition and Responses - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access monitoring

system design documentation

system configuration settings and associated documentation

system audit records

list of response actions to be initiated when specific classes/types of intrusions are recognized

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with physical access monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for monitoring physical access

automated mechanisms supporting and/or implementing physical access monitoring

automated mechanisms supporting and/or implementing recognition of classes/types of intrusions and initiation of a response
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(2) > Assessment Objective

PE-6(2) Automated Intrusion Recognition and Responses - Assessment Objective
Determine if the following are satisfied:

PE-06(02)[01] [Assignment: organization-defined classes or types of intrusions] are recognized;
PE-06(02)[02] [Assignment: organization-defined response actions] are initiated using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(3) > Assessment Methods

PE-6(3) Video Surveillance - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access monitoring

video surveillance equipment used to monitor operational areas

video recordings of operational areas where video surveillance is employed

video surveillance equipment logs or records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with physical access monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for monitoring physical access

mechanisms supporting and/or implementing physical access monitoring

mechanisms supporting and/or implementing video surveillance