ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(12) > Discussion

SI-4(12) Automated Organization-generated Alerts - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Organizational personnel on the system alert notification list include system administrators, mission or business owners, system owners, senior agency information security officer, senior agency official for privacy, system security officers, or privacy officers. Automated organization-generated alerts are the security alerts generated by organizations and transmitted using automated means. The sources for organization-generated alerts are focused on other entities such as suspicious activity reports and reports on potential insider threats. In contrast to alerts generated by the organization, alerts generated by the system in [SI-4(5)](#si-4.5) focus on information sources that are internal to the systems, such as audit records.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(12)

SI-4(12) System Monitoring | Automated Organization-generated Alerts
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(13) > Discussion

SI-4(13) Analyze Traffic and Event Patterns - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Identifying and understanding common communications traffic and event patterns help organizations provide useful information to system monitoring devices to more effectively identify suspicious or anomalous traffic and events when they occur. Such information can help reduce the number of false positives and false negatives during system monitoring.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(13)

SI-4(13) System Monitoring | Analyze Traffic and Event Patterns
Family: System and Information Integrity (SI) > SI-4 System Monitoring

(a) Analyze communications traffic and event patterns for the system;
(b) Develop profiles representing common traffic and event patterns; and
(c) Use the traffic and event profiles in tuning system-monitoring devices.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(14) > Discussion

SI-4(14) Wireless Intrusion Detection - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Wireless signals may radiate beyond organizational facilities. Organizations proactively search for unauthorized wireless connections, including the conduct of thorough scans for unauthorized wireless access points. Wireless scans are not limited to those areas within facilities containing systems but also include areas outside of facilities to verify that unauthorized wireless access points are not connected to organizational systems.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(14)

SI-4(14) System Monitoring | Wireless Intrusion Detection
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(15) > Discussion

SI-4(15) Wireless to Wireline Communications - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Wireless networks are inherently less secure than wired networks. For example, wireless networks are more susceptible to eavesdroppers or traffic analysis than wireline networks. When wireless to wireline communications exist, the wireless network could become a port of entry into the wired network. Given the greater facility of unauthorized network access via wireless access points compared to unauthorized wired network access from within the physical boundaries of the system, additional monitoring of transitioning traffic between wireless and wired networks may be necessary to detect malicious activities. Employing intrusion detection systems to monitor wireless communications traffic helps to ensure that the traffic does not contain malicious code prior to transitioning to the wireline network.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(15)

SI-4(15) System Monitoring | Wireless to Wireline Communications
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(16) > Discussion

SI-4(16) Correlate Monitoring Information - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Correlating information from different system monitoring tools and mechanisms can provide a more comprehensive view of system activity. Correlating system monitoring tools and mechanisms that typically work in isolation-including malicious code protection software, host monitoring, and network monitoring-can provide an organization-wide monitoring view and may reveal otherwise unseen attack patterns. Understanding the capabilities and limitations of diverse monitoring tools and mechanisms and how to maximize the use of information generated by those tools and mechanisms can help organizations develop, operate, and maintain effective monitoring programs. The correlation of monitoring information is especially important during the transition from older to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols).
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(16)

SI-4(16) System Monitoring | Correlate Monitoring Information
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Correlate information from monitoring tools and mechanisms employed throughout the system.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(17) > Discussion

SI-4(17) Integrated Situational Awareness - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Correlating monitoring information from a more diverse set of information sources helps to achieve integrated situational awareness. Integrated situational awareness from a combination of physical, cyber, and supply chain monitoring activities enhances the capability of organizations to more quickly detect sophisticated attacks and investigate the methods and techniques employed to carry out such attacks. In contrast to [SI-4(16)](#si-4.16) , which correlates the various cyber monitoring information, integrated situational awareness is intended to correlate monitoring beyond the cyber domain. Correlation of monitoring information from multiple activities may help reveal attacks on organizations that are operating across multiple attack vectors.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(17)

SI-4(17) System Monitoring | Integrated Situational Awareness
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(18) > Discussion

SI-4(18) Analyze Traffic and Covert Exfiltration - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Organization-defined interior points include subnetworks and subsystems. Covert means that can be used to exfiltrate information include steganography.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(18)

SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(19) > Discussion

SI-4(19) Risk for Individuals - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Indications of increased risk from individuals can be obtained from different sources, including personnel records, intelligence agencies, law enforcement organizations, and other sources. The monitoring of individuals is coordinated with the management, legal, security, privacy, and human resource officials who conduct such monitoring. Monitoring is conducted in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(19)

SI-4(19) System Monitoring | Risk for Individuals
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Implement [Assignment: organization-defined additional monitoring] of individuals who have been identified by [Assignment: organization-defined sources] as posing an increased level of risk.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(20) > Discussion

SI-4(20) Privileged Users - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Privileged users have access to more sensitive information, including security-related information, than the general user population. Access to such information means that privileged users can potentially do greater damage to systems and organizations than non-privileged users. Therefore, implementing additional monitoring on privileged users helps to ensure that organizations can identify malicious activity at the earliest possible time and take appropriate actions.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(20)

SI-4(20) System Monitoring | Privileged Users
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(21) > Discussion

SI-4(21) Probationary Periods - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

During probationary periods, employees do not have permanent employment status within organizations. Without such status or access to information that is resident on the system, additional monitoring can help identify any potentially malicious activity or inappropriate behavior.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(21)

SI-4(21) System Monitoring | Probationary Periods
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Implement the following additional monitoring of individuals during [Assignment: organization-defined probationary period]: [Assignment: organization-defined additional monitoring].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(22) > Discussion

SI-4(22) Unauthorized Network Services - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Unauthorized or unapproved network services include services in service-oriented architectures that lack organizational verification or validation and may therefore be unreliable or serve as malicious rogues for valid services.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(22)

SI-4(22) System Monitoring | Unauthorized Network Services
Family: System and Information Integrity (SI) > SI-4 System Monitoring

(a) Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes] ; and
(b) [Selection; one or more: audit; alert [Assignment: organization-defined personnel or roles] ] when detected.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(23) > Discussion

SI-4(23) Host-based Devices - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Host-based monitoring collects information about the host (or system in which it resides). System components in which host-based monitoring can be implemented include servers, notebook computers, and mobile devices. Organizations may consider employing host-based monitoring mechanisms from multiple product developers or vendors.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(23)

SI-4(23) System Monitoring | Host-based Devices
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(24) > Discussion

SI-4(24) Indicators of Compromise - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Indicators of compromise (IOC) are forensic artifacts from intrusions that are identified on organizational systems at the host or network level. IOCs provide valuable information on systems that have been compromised. IOCs can include the creation of registry key values. IOCs for network traffic include Universal Resource Locator or protocol elements that indicate malicious code command and control servers. The rapid distribution and adoption of IOCs can improve information security by reducing the time that systems and organizations are vulnerable to the same exploit or attack. Threat indicators, signatures, tactics, techniques, procedures, and other indicators of compromise may be available via government and non-government cooperatives, including the Forum of Incident Response and Security Teams, the United States Computer Emergency Readiness Team, the Defense Industrial Base Cybersecurity Information Sharing Program, and the CERT Coordination Center.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(24)

SI-4(24) System Monitoring | Indicators of Compromise
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Discover, collect, and distribute to [Assignment: organization-defined personnel or roles] , indicators of compromise provided by [Assignment: organization-defined sources].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(25) > Discussion

SI-4(25) Optimize Network Traffic Analysis - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Encrypted traffic, asymmetric routing architectures, capacity and latency limitations, and transitioning from older to newer technologies (e.g., IPv4 to IPv6 network protocol transition) may result in blind spots for organizations when analyzing network traffic. Collecting, decrypting, pre-processing, and distributing only relevant traffic to monitoring devices can streamline the efficiency and use of devices and optimize traffic analysis.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(25)

SI-4(25) System Monitoring | Optimize Network Traffic Analysis
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-5

SI-5 Security Alerts, Advisories, and Directives
Family: System and Information Integrity (SI)

a. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis;
b. Generate internal security alerts, advisories, and directives as deemed necessary;
c. Disseminate security alerts, advisories, and directives to: [Selection; one or more: [Assignment: organization-defined personnel or roles] ; [Assignment: organization-defined elements] ; [Assignment: organization-defined external organizations] ] ; and
d. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-5 > Discussion

SI-5 Security Alerts, Advisories, and Directives - Discussion
Family: System and Information Integrity (SI)

The Cybersecurity and Infrastructure Security Agency (CISA) generates security alerts and advisories to maintain situational awareness throughout the Federal Government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance with security directives is essential due to the critical nature of many of these directives and the potential (immediate) adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner. External organizations include supply chain partners, external mission or business partners, external service providers, and other peer or supporting organizations.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-5 > SI-5(1) > Discussion

SI-5(1) Automated Alerts and Advisories - Discussion
Family: System and Information Integrity (SI) > SI-5 Security Alerts, Advisories, and Directives

The significant number of changes to organizational systems and environments of operation requires the dissemination of security-related information to a variety of organizational entities that have a direct interest in the success of organizational mission and business functions. Based on information provided by security alerts and advisories, changes may be required at one or more of the three levels related to the management of risk, including the governance level, mission and business process level, and the information system level.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-5 > SI-5(1)

SI-5(1) Security Alerts, Advisories, and Directives | Automated Alerts and Advisories
Family: System and Information Integrity (SI) > SI-5 Security Alerts, Advisories, and Directives

Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-6

SI-6 Security and Privacy Function Verification
Family: System and Information Integrity (SI)

a. Verify the correct operation of [Assignment: organization-defined organization-defined security and privacy functions];
b. Perform the verification of the functions specified in SI-6a [Selection; one or more: [Assignment: organization-defined system transitional states] ; upon command by user with appropriate privilege; [Assignment: organization-defined frequency] ];
c. Alert [Assignment: organization-defined personnel or roles] to failed security and privacy verification tests; and
d. [Selection; one or more: shut the system down; restart the system; [Assignment: organization-defined alternative action(s)] ] when anomalies are discovered.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-6 > Discussion

SI-6 Security and Privacy Function Verification - Discussion
Family: System and Information Integrity (SI)

Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-6 > SI-6(2) > Discussion

SI-6(2) Automation Support for Distributed Testing - Discussion
Family: System and Information Integrity (SI) > SI-6 Security and Privacy Function Verification

The use of automated mechanisms to support the management of distributed function testing helps to ensure the integrity, timeliness, completeness, and efficacy of such testing.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-6 > SI-6(2)

SI-6(2) Security and Privacy Function Verification | Automation Support for Distributed Testing
Family: System and Information Integrity (SI) > SI-6 Security and Privacy Function Verification

Implement automated mechanisms to support the management of distributed security and privacy function testing.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-6 > SI-6(3) > Discussion

SI-6(3) Report Verification Results - Discussion
Family: System and Information Integrity (SI) > SI-6 Security and Privacy Function Verification

Organizational personnel with potential interest in the results of the verification of security and privacy functions include systems security officers, senior agency information security officers, and senior agency officials for privacy.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-6 > SI-6(3)

SI-6(3) Security and Privacy Function Verification | Report Verification Results
Family: System and Information Integrity (SI) > SI-6 Security and Privacy Function Verification

Report the results of security and privacy function verification to [Assignment: organization-defined personnel or roles].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7

SI-7 Software, Firmware, and Information Integrity
Family: System and Information Integrity (SI)

a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined organization-defined software, firmware, and information] ; and
b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined organization-defined actions].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > Discussion

SI-7 Software, Firmware, and Information Integrity - Discussion
Family: System and Information Integrity (SI)

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms-including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools-can automatically monitor the integrity of systems and hosted applications.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(1) > Discussion

SI-7(1) Integrity Checks - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of new hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort.