ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(17) > Assessment Methods

SC-7(17) Automated Enforcement of Protocol Formats - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the enforcement of adherence to protocol formats
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(17) > Assessment Objective

SC-7(17) Automated Enforcement of Protocol Formats - Assessment Objective
Determine if the following are satisfied:

adherence to protocol formats is enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(18) > Assessment Methods

SC-7(18) Fail Secure - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing secure failure
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(18) > Assessment Objective

SC-7(18) Fail Secure - Assessment Objective
Determine if the following are satisfied:

systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(19) > Assessment Methods

SC-7(19) Block Communication from Non-organizationally Configured Hosts - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

list of communication clients independently configured by end users and external service providers

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the blocking of inbound and outbound communications traffic between communication clients independently configured by end users and external service providers
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(19) > Assessment Objective

SC-7(19) Block Communication from Non-organizationally Configured Hosts - Assessment Objective
Determine if the following are satisfied:

SC-07(19)[01] inbound communications traffic is blocked between [Assignment: organization-defined communication clients] that are independently configured by end users and external service providers;
SC-07(19)[02] outbound communications traffic is blocked between [Assignment: organization-defined communication clients] that are independently configured by end users and external service providers.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(20) > Assessment Methods

SC-7(20) Dynamic Isolation and Segregation - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

list of system components to be dynamically isolated/segregated from other components of the system

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the capability to dynamically isolate/segregate system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(20) > Assessment Objective

SC-7(20) Dynamic Isolation and Segregation - Assessment Objective
Determine if the following are satisfied:

the capability to dynamically isolate [Assignment: organization-defined system components] from other system components is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(21) > Assessment Methods

SC-7(21) Isolation of System Components - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

enterprise architecture documentation

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the capability to separate system components supporting organizational missions and/or business functions
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(21) > Assessment Objective

SC-7(21) Isolation of System Components - Assessment Objective
Determine if the following are satisfied:

boundary protection mechanisms are employed to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(22) > Assessment Methods

SC-7(22) Separate Subnets for Connecting to Different Security Domains - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing separate network addresses/different subnets
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(22) > Assessment Objective

SC-7(22) Separate Subnets for Connecting to Different Security Domains - Assessment Objective
Determine if the following are satisfied:

separate network addresses are implemented to connect to systems in different security domains.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(23) > Assessment Methods

SC-7(23) Disable Sender Feedback on Protocol Validation Failure - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms supporting and/or implementing the disabling of feedback to senders on protocol format validation failure
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(23) > Assessment Objective

SC-7(23) Disable Sender Feedback on Protocol Validation Failure - Assessment Objective
Determine if the following are satisfied:

feedback to senders is disabled on protocol format validation failure.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(24) > Assessment Methods

SC-7(24) Personally Identifiable Information - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

personally identifiable information processing policies

list of key internal boundaries of the system

system design documentation

system configuration settings and associated documentation

enterprise security and privacy architecture documentation

system audit records

system security plan

privacy plan

personally identifiable information inventory documentation

data mapping documentation

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms implementing boundary protection capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(24) > Assessment Objective

SC-7(24) Personally Identifiable Information - Assessment Objective
Determine if the following are satisfied:

SC-07(24)(a) [Assignment: organization-defined processing rules] are applied to data elements of personally identifiable information on systems that process personally identifiable information;
SC-07(24)(b)[01] permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;
SC-07(24)(b)[02] permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;
SC-07(24)(c) each processing exception is documented for systems that process personally identifiable information;
SC-07(24)(d)[01] exceptions for systems that process personally identifiable information are reviewed;
SC-07(24)(d)[02] exceptions for systems that process personally identifiable information that are no longer supported are removed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(25) > Assessment Methods

SC-7(25) Unclassified National Security System Connections - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms prohibiting the direct connection of unclassified national security systems to an external network
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(25) > Assessment Objective

SC-7(25) Unclassified National Security System Connections - Assessment Objective
Determine if the following are satisfied:

the direct connection of [Assignment: organization-defined unclassified national security system] to an external network without the use of [Assignment: organization-defined boundary protection device] is prohibited.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(26) > Assessment Methods

SC-7(26) Classified National Security System Connections - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms prohibiting the direct connection of classified national security systems to an external network
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(26) > Assessment Objective

SC-7(26) Classified National Security System Connections - Assessment Objective
Determine if the following are satisfied:

the direct connection of classified national security system to an external network without the use of a [Assignment: organization-defined boundary protection device] is prohibited.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(27) > Assessment Methods

SC-7(27) Unclassified Non-national Security System Connections - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms prohibiting the direct connection of unclassified, non-national security systems to an external network
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(27) > Assessment Objective

SC-7(27) Unclassified Non-national Security System Connections - Assessment Objective
Determine if the following are satisfied:

the direct connection of [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of a [Assignment: organization-defined boundary protection device] is prohibited.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(28) > Assessment Methods

SC-7(28) Connections to Public Networks - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms prohibiting the direct connection of systems to an external network
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(28) > Assessment Objective

SC-7(28) Connections to Public Networks - Assessment Objective
Determine if the following are satisfied:

the direct connection of the [Assignment: organization-defined system] to a public network is prohibited.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(29) > Assessment Methods

SC-7(29) Separate Subnets to Isolate Functions - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

criticality analysis

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Test: Mechanisms separating critical system components and functions
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-7 > SC-7(29) > Assessment Objective

SC-7(29) Separate Subnets to Isolate Functions - Assessment Objective
Determine if the following are satisfied:

subnetworks are separated [Selection: physically; logically] to isolate [Assignment: organization-defined critical system components and functions].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > Assessment Methods

SC-8 Transmission Confidentiality and Integrity - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing transmission confidentiality and integrity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing transmission confidentiality and/or integrity
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > Assessment Objective

SC-8 Transmission Confidentiality and Integrity - Assessment Objective
Determine if the following are satisfied:

the [Selection; one or more: confidentiality; integrity] of transmitted information is/are protected.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(1) > Assessment Methods

SC-8(1) Cryptographic Protection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing transmission confidentiality and integrity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity

mechanisms supporting and/or implementing alternative physical safeguards

organizational processes for defining and implementing alternative physical safeguards
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(1) > Assessment Objective

SC-8(1) Cryptographic Protection - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to [Selection; one or more: prevent unauthorized disclosure of information; detect changes to information] during transmission.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(2) > Assessment Methods

SC-8(2) Pre- and Post-transmission Handling - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing transmission confidentiality and integrity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing transmission confidentiality and/or integrity
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(2) > Assessment Objective

SC-8(2) Pre- and Post-transmission Handling - Assessment Objective
Determine if the following are satisfied:

SC-08(02)[01] information [Selection; one or more: confidentiality; integrity] is/are maintained during preparation for transmission;
SC-08(02)[02] information [Selection; one or more: confidentiality; integrity] is/are maintained during reception.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(3) > Assessment Methods

SC-8(3) Cryptographic Protection for Message Externals - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing transmission confidentiality and integrity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity for message externals

mechanisms supporting and/or implementing alternative physical safeguards

organizational processes for defining and implementing alternative physical safeguards
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(3) > Assessment Objective

SC-8(3) Cryptographic Protection for Message Externals - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(4) > Assessment Methods

SC-8(4) Conceal or Randomize Communications - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing transmission confidentiality and integrity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Cryptographic mechanisms supporting and/or implementing concealment or randomization of communication patterns

mechanisms supporting and/or implementing alternative physical safeguards

organizational processes for defining and implementing alternative physical safeguards
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(4) > Assessment Objective

SC-8(4) Conceal or Randomize Communications - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(5) > Assessment Methods

SC-8(5) Protected Distribution System - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing transmission confidentiality and integrity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Cryptographic mechanisms supporting and/or implementing concealment or randomization of communication patterns

mechanisms supporting and/or implementing protected distribution systems