ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-34 > SC-34(1) > Assessment Methods

SC-34(1) No Writable Storage - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing non-modifiable executable programs

system design documentation

system configuration settings and associated documentation

system architecture

list of system components to be employed without writeable storage capabilities

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Mechanisms supporting and/or implementing the employment of components with no writeable storage

mechanisms supporting and/or implementing persistent non-writeable storage across component restart and power on/off
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-34 > SC-34(1) > Assessment Objective

SC-34(1) No Writable Storage - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined system components] are employed with no writeable storage that is persistent across component restart or power on/off.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-34 > SC-34(2) > Assessment Methods

SC-34(2) Integrity Protection on Read-only Media - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing non-modifiable executable programs

system design documentation

system configuration settings and associated documentation

system architecture

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Mechanisms supporting and/or implementing the capability to protect information integrity on read-only media prior to storage and after information has been recorded onto the media
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-34 > SC-34(2) > Assessment Objective

SC-34(2) Integrity Protection on Read-only Media - Assessment Objective
Determine if the following are satisfied:

SC-34(02)[01] the integrity of information is protected prior to storage on read-only media;
SC-34(02)[02] the media is controlled after such information has been recorded onto the media;
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-35 > Assessment Methods

SC-35 External Malicious Code Identification - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing external malicious code identification

system design documentation

system configuration settings and associated documentation

system components deployed to identify malicious websites and/or web-based malicious code

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Automated mechanisms supporting and/or implementing external malicious code identification
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-35 > Assessment Objective

SC-35 External Malicious Code Identification - Assessment Objective
Determine if the following are satisfied:

system components that proactively seek to identify network-based malicious code or malicious websites are included.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-36 > Assessment Methods

SC-36 Distributed Processing and Storage - Assessment Methods and Objects

Examine: System and communications protection policy

contingency planning policy and procedures

contingency plan

system design documentation

system configuration settings and associated documentation

system architecture

list of system physical locations (or environments) with distributed processing and storage

system facility diagrams

processing site agreements

storage site agreements

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel with contingency planning and plan implementation responsibilities

system developers/integrators

Test: Organizational processes for distributed processing and storage across multiple physical locations

mechanisms supporting and/or implementing the capability to distribute processing and storage across multiple physical locations
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-36 > Assessment Objective

SC-36 Distributed Processing and Storage - Assessment Objective
Determine if the following are satisfied:

SC-36[01] [Assignment: organization-defined processing components] are distributed across [Selection: physical locations; logical domains];
SC-36[02] [Assignment: organization-defined storage components] are distributed across [Selection: physical locations; logical domains].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-36 > SC-36(1) > Assessment Methods

SC-36(1) Polling Techniques - Assessment Methods and Objects

Examine: System and communications protection policy

system design documentation

system configuration settings and associated documentation

system architecture

list of distributed processing and storage components subject to polling

system polling techniques and associated documentation or records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Mechanisms supporting and/or implementing polling techniques
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-36 > SC-36(1) > Assessment Objective

SC-36(1) Polling Techniques - Assessment Objective
Determine if the following are satisfied:

SC-36(01)(a) polling techniques are employed to identify potential faults, errors, or compromises to [Assignment: organization-defined distributed processing and storage components];
SC-36(01)(b) [Assignment: organization-defined actions] are taken in response to identified faults, errors, or compromise.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-36 > SC-36(2) > Assessment Methods

SC-36(2) Synchronization - Assessment Methods and Objects

Examine: System and communications protection policy

system design documentation

system configuration settings and associated documentation

system architecture

list of distributed processing and storage components subject to polling

system polling techniques and associated documentation or records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Mechanisms supporting and/or implementing duplicate system or system component synchronization
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-36 > SC-36(2) > Assessment Objective

SC-36(2) Synchronization - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined duplicate systems or system components] are synchronized.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-37 > Assessment Methods

SC-37 Out-of-band Channels - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the use of out-of-band channels

access control policy and procedures

identification and authentication policy and procedures

system design documentation

system architecture

system configuration settings and associated documentation

list of out-of-band channels

types of information, system components, or devices requiring the use of out-of-band channels for physical delivery or electronic transmission to authorized individuals or systems

physical delivery records

electronic transmission records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, operating, and/or using out-of-band channels

system developers/integrators

Test: Organizational processes for the use of out-of-band channels

mechanisms supporting and/or implementing the use of out-of-band channels
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-37 > Assessment Objective

SC-37 Out-of-band Channels - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined out-of-band channels] are employed for the physical delivery or electronic transmission of [Assignment: organization-defined information, system components, or devices] to [Assignment: organization-defined individuals or systems].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-37 > SC-37(1) > Assessment Methods

SC-37(1) Ensure Delivery and Transmission - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the use of out-of-band channels

access control policy and procedures

identification and authentication policy and procedures

system design documentation

system architecture

system configuration settings and associated documentation

list of security safeguards to be employed to ensure that designated individuals or systems receive organization-defined information, system components, or devices

list of security safeguards for delivering designated information, system components, or devices to designated individuals or systems

list of information, system components, or devices to be delivered to designated individuals or systems

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, operating, and/or using out-of-band channels

system developers/integrators

Test: Organizational processes for the use of out-of-band channels

mechanisms supporting and/or implementing the use of out-of-band channels

mechanisms supporting/implementing safeguards to ensure the delivery of designated information, system components, or devices
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-37 > SC-37(1) > Assessment Objective

SC-37(1) Ensure Delivery and Transmission - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls] are employed to ensure that only [Assignment: organization-defined individuals or systems] receive [Assignment: organization-defined information, system components, or devices].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-38 > Assessment Methods

SC-38 Operations Security - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing operations security

security plan

list of operations security safeguards

security control assessments

risk assessments

threat and vulnerability assessments

plans of action and milestones

system development life cycle documentation

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Organizational processes for protecting organizational information throughout the system development life cycle

mechanisms supporting and/or implementing safeguards to protect organizational information throughout the system development life cycle
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-38 > Assessment Objective

SC-38 Operations Security - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined operations security controls] are employed to protect key organizational information throughout the system development life cycle.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-39 > Assessment Methods

SC-39 Process Isolation - Assessment Methods and Objects

Examine: System design documentation

system architecture

independent verification and validation documentation

testing and evaluation documentation

other relevant documents or records

Interview: System developers/integrators

system security architect

Test: Mechanisms supporting and/or implementing separate execution domains for each executing process
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-39 > Assessment Objective

SC-39 Process Isolation - Assessment Objective
Determine if the following are satisfied:

a separate execution domain is maintained for each executing system process.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-39 > SC-39(1) > Assessment Methods

SC-39(1) Hardware Separation - Assessment Methods and Objects

Examine: System and communications protection policy

system design documentation

system configuration settings and associated documentation

system architecture

system documentation for hardware separation mechanisms

system documentation from vendors, manufacturers, or developers

independent verification and validation documentation

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: System capability implementing underlying hardware separation mechanisms for process separation
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-39 > SC-39(1) > Assessment Objective

SC-39(1) Hardware Separation - Assessment Objective
Determine if the following are satisfied:

hardware separation is implemented to facilitate process isolation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-39 > SC-39(2) > Assessment Methods

SC-39(2) Separate Execution Domain Per Thread - Assessment Methods and Objects

Examine: System and communications protection policy

system design documentation

system configuration settings and associated documentation

system architecture

list of system execution domains for each thread in multi-threaded processing

system documentation for multi-threaded processing

system documentation from vendors, manufacturers, or developers

independent verification and validation documentation

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: System capability implementing a separate execution domain for each thread in multi-threaded processing
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-39 > SC-39(2) > Assessment Objective

SC-39(2) Separate Execution Domain Per Thread - Assessment Objective
Determine if the following are satisfied:

a separate execution domain is maintained for each thread in [Assignment: organization-defined multi-threaded processing].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > Assessment Methods

SC-40 Wireless Link Protection - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

procedures addressing wireless link protection

system design documentation

wireless network diagrams

system configuration settings and associated documentation

system architecture

list of internal and external wireless links

list of signal parameter attacks or references to sources for attacks

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, and/or maintaining internal and external wireless links

Test: Mechanisms supporting and/or implementing the protection of wireless links
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > Assessment Objective

SC-40 Wireless Link Protection - Assessment Objective
Determine if the following are satisfied:

SC-40[01] external [Assignment: organization-defined wireless links] are protected from [Assignment: organization-defined types of signal parameter attacks or references to sources for such attacks].
SC-40[02] internal [Assignment: organization-defined wireless links] are protected from [Assignment: organization-defined types of signal parameter attacks or references to sources for such attacks].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(1) > Assessment Methods

SC-40(1) Electromagnetic Interference - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

procedures addressing wireless link protection

system design documentation

wireless network diagrams

system configuration settings and associated documentation

system architecture

system communications hardware and software

security categorization results

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, and/or maintaining internal and external wireless links

Test: Cryptographic mechanisms enforcing protections against effects of intentional electromagnetic interference
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(1) > Assessment Objective

SC-40(1) Electromagnetic Interference - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms that achieve [Assignment: organization-defined level of protection] against the effects of intentional electromagnetic interference are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(2) > Assessment Methods

SC-40(2) Reduce Detection Potential - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

procedures addressing wireless link protection

system design documentation

wireless network diagrams

system configuration settings and associated documentation

system architecture

system communications hardware and software

security categorization results

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, and/or maintaining internal and external wireless links

Test: Cryptographic mechanisms enforcing protections to reduce the detection of wireless links
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(2) > Assessment Objective

SC-40(2) Reduce Detection Potential - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms to reduce the detection potential of wireless links to [Assignment: organization-defined level of reduction] are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(3) > Assessment Methods

SC-40(3) Imitative or Manipulative Communications Deception - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

procedures addressing system design documentation

wireless network diagrams

system configuration settings and associated documentation

system architecture

system communications hardware and software

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, and/or maintaining internal and external wireless links

Test: Cryptographic mechanisms enforcing wireless link protections against imitative or manipulative communications deception
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(3) > Assessment Objective

SC-40(3) Imitative or Manipulative Communications Deception - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(4) > Assessment Methods

SC-40(4) Signal Parameter Identification - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

procedures addressing system design documentation

wireless network diagrams

system configuration settings and associated documentation

system architecture

system communications hardware and software

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, and/or maintaining internal and external wireless links

Test: Cryptographic mechanisms preventing the identification of wireless transmitters
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-40 > SC-40(4) > Assessment Objective

SC-40(4) Signal Parameter Identification - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to prevent the identification of [Assignment: organization-defined wireless transmitters] by using the transmitter signal parameters.