ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > Assessment Methods

IR-4 Incident Handling - Assessment Methods and Objects

Examine: Incident response policy

contingency planning policy

procedures addressing incident handling

incident response plan

contingency plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with contingency planning responsibilities

organizational personnel with information security and privacy responsibilities

Test: Incident handling capability for the organization
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > Assessment Objective

IR-4 Incident Handling - Assessment Objective
Determine if the following are satisfied:

IR-04a.[01] an incident handling capability for incidents is implemented that is consistent with the incident response plan;
IR-04a.[02] the incident handling capability for incidents includes preparation;
IR-04a.[03] the incident handling capability for incidents includes detection and analysis;
IR-04a.[04] the incident handling capability for incidents includes containment;
IR-04a.[05] the incident handling capability for incidents includes eradication;
IR-04a.[06] the incident handling capability for incidents includes recovery;
IR-04b. incident handling activities are coordinated with contingency planning activities;
IR-04c.[01] lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing;
IR-04c.[02] the changes resulting from the incorporated lessons learned are implemented accordingly;
IR-04d.[01] the rigor of incident handling activities is comparable and predictable across the organization;
IR-04d.[02] the intensity of incident handling activities is comparable and predictable across the organization;
IR-04d.[03] the scope of incident handling activities is comparable and predictable across the organization;
IR-04d.[04] the results of incident handling activities are comparable and predictable across the organization.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(1) > Assessment Methods

IR-4(1) Automated Incident Handling Processes - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

automated mechanisms supporting incident handling

system design documentation

system configuration settings and associated documentation

system audit records

incident response plan

system security plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

Test: Automated mechanisms that support and/or implement the incident handling process
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(1) > Assessment Objective

IR-4(1) Automated Incident Handling Processes - Assessment Objective
Determine if the following are satisfied:

the incident handling process is supported using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(2) > Assessment Methods

IR-4(2) Dynamic Reconfiguration - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

mechanisms supporting incident handling

list of system components to be dynamically reconfigured as part of incident response capability

system design documentation

system configuration settings and associated documentation

system audit records

incident response plan

system security plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms that support and/or implement the dynamic reconfiguration of components as part of incident response
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(2) > Assessment Objective

IR-4(2) Dynamic Reconfiguration - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined types of dynamic reconfiguration] for [Assignment: organization-defined system components] are included as part of the incident response capability.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(3) > Assessment Methods

IR-4(3) Continuity of Operations - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

incident response plan

privacy plan

list of classes of incidents

list of appropriate incident response actions

system security plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms that support and/or implement continuity of operations
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(3) > Assessment Objective

IR-4(3) Continuity of Operations - Assessment Objective
Determine if the following are satisfied:

IR-04(03)[01] [Assignment: organization-defined classes of incidents] are identified;
IR-04(03)[02] [Assignment: organization-defined actions] are taken in response to those incidents (defined in IR-04(03)_ODP[01]) to ensure the continuation of organizational mission and business functions.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(4) > Assessment Methods

IR-4(4) Information Correlation - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

incident response plan

privacy plan

mechanisms supporting incident and event correlation

system design documentation

system configuration settings and associated documentation

system security plan

privacy plan

incident management correlation logs

event management correlation logs

security information and event management logs

incident management correlation reports

event management correlation reports

security information and event management reports

audit records

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with whom incident information and individual incident responses are to be correlated

Test: Organizational processes for correlating incident information and individual incident responses

mechanisms that support and or implement the correlation of incident response information with individual incident responses
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(4) > Assessment Objective

IR-4(4) Information Correlation - Assessment Objective
Determine if the following are satisfied:

incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(5) > Assessment Methods

IR-4(5) Automatic Disabling of System - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

automated mechanisms supporting incident handling

system design documentation

system configuration settings and associated documentation

system security plan

incident response plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

system developers

Test: Incident handling capability for the organization

automated mechanisms supporting and/or implementing automatic disabling of the system
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(5) > Assessment Objective

IR-4(5) Automatic Disabling of System - Assessment Objective
Determine if the following are satisfied:

a configurable capability is implemented to automatically disable the system if [Assignment: organization-defined security violations] are detected.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(6) > Assessment Methods

IR-4(6) Insider Threats - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

mechanisms supporting incident handling

system design documentation

system configuration settings and associated documentation

incident response plan

system security plan

audit records

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

Test: Incident handling capability for the organization
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(6) > Assessment Objective

IR-4(6) Insider Threats - Assessment Objective
Determine if the following are satisfied:

an incident handling capability is implemented for incidents involving insider threats.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(7) > Assessment Methods

IR-4(7) Insider Threats - Intra-organization Coordination - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

incident response plan

insider threat program plan

insider threat CONOPS

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel/elements with whom the incident handling capability is to be coordinated

Test: Organizational processes for coordinating incident handling
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(7) > Assessment Objective

IR-4(7) Insider Threats - Intra-organization Coordination - Assessment Objective
Determine if the following are satisfied:

IR-04(07)[01] an incident handling capability is coordinated for insider threats;
IR-04(07)[02] the coordinated incident handling capability includes [Assignment: organization-defined entities].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(8) > Assessment Methods

IR-4(8) Correlation with External Organizations - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

list of external organizations

records of incident handling coordination with external organizations

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security and privacy responsibilities

personnel from external organizations with whom incident response information is to be coordinated, shared, and correlated

Test: Organizational processes for coordinating incident handling information with external organizations
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(8) > Assessment Objective

IR-4(8) Correlation with External Organizations - Assessment Objective
Determine if the following are satisfied:

there is coordination with [Assignment: organization-defined external organizations] to correlate and share [Assignment: organization-defined incident information] to achieve a cross-organization perspective on incident awareness and more effective incident responses.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(9) > Assessment Methods

IR-4(9) Dynamic Response Capability - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

automated mechanisms supporting dynamic response capabilities

system design documentation

system configuration settings and associated documentation

incident response plan

system security plan

audit records

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for dynamic response capability

automated mechanisms supporting and/or implementing the dynamic response capability for the organization
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(9) > Assessment Objective

IR-4(9) Dynamic Response Capability - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined dynamic response capabilities] are employed to respond to incidents.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(10) > Assessment Methods

IR-4(10) Supply Chain Coordination - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing supply chain coordination and supply chain risk information sharing with the Federal Acquisition Security Council

acquisition contracts

service-level agreements

incident response plan

supply chain risk management plan

system security plan

incident response plans of other organization involved in supply chain activities

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with mission and business responsibilities

organizational personnel with legal responsibilities

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

organizational personnel with acquisition responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(10) > Assessment Objective

IR-4(10) Supply Chain Coordination - Assessment Objective
Determine if the following are satisfied:

incident handling activities involving supply chain events are coordinated with other organizations involved in the supply chain.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(11) > Assessment Methods

IR-4(11) Integrated Incident Response Team - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

procedures addressing incident response planning

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security and privacy responsibilities

members of the integrated incident response team
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(11) > Assessment Objective

IR-4(11) Integrated Incident Response Team - Assessment Objective
Determine if the following are satisfied:

IR-04(11)[01] an integrated incident response team is established and maintained;
IR-04(11)[02] the integrated incident response team can be deployed to any location identified by the organization in [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(12) > Assessment Methods

IR-4(12) Malicious Code and Forensic Analysis - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident handling

procedures addressing code and forensic analysis

procedures addressing incident response

incident response plan

system design documentation

malicious code protection mechanisms, tools, and techniques

results from malicious code analyses

system security plan

system audit records

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel with responsibility for malicious code protection

organizational personnel responsible for incident response/management

Test: Organizational process for incident response

organizational processes for conducting forensic analysis

tools and techniques for analysis of malicious code characteristics and behavior
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(12) > Assessment Objective

IR-4(12) Malicious Code and Forensic Analysis - Assessment Objective
Determine if the following are satisfied:

IR-04(12)[01] malicious code remaining in the system is analyzed after the incident;
IR-04(12)[02] other residual artifacts remaining in the system (if any) are analyzed after the incident.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(13) > Assessment Methods

IR-4(13) Behavior Analysis - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing system monitoring tools and techniques

incident response plan

system monitoring logs or records

system monitoring tools and techniques documentation

system configuration settings and associated documentation

security plan

system component inventory

network diagram

system protocols documentation

list of acceptable thresholds for false positives and false negatives

system security plan

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for detecting anomalous behavior
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(13) > Assessment Objective

IR-4(13) Behavior Analysis - Assessment Objective
Determine if the following are satisfied:

anomalous or suspected adversarial behavior in or related to [Assignment: organization-defined environments or resources] are analyzed.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(14) > Assessment Methods

IR-4(14) Security Operations Center - Assessment Methods and Objects

Examine: Incident response policy

contingency planning policy

procedures addressing incident handling

procedures addressing the security operations center operations

mechanisms supporting dynamic response capabilities

incident response plan

contingency plan

system security plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with contingency planning responsibilities

security operations center personnel

organizational personnel with information security responsibilities

Test: Mechanisms that support and/or implement the security operations center capability

mechanisms that support and/or implement the incident handling process
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(14) > Assessment Objective

IR-4(14) Security Operations Center - Assessment Objective
Determine if the following are satisfied:

IR-04(14)[01] a security operations center is established;
IR-04(14)[02] a security operations center is maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(15) > Assessment Methods

IR-4(15) Public Relations and Reputation Repair - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response

procedures addressing incident handling

incident response plan

system security plan

other relevant documents or records

Interview: Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

organizational personnel with communications or public relations responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-4 > IR-4(15) > Assessment Objective

IR-4(15) Public Relations and Reputation Repair - Assessment Objective
Determine if the following are satisfied:

IR-04(15)(a) public relations associated with an incident are managed;
IR-04(15)(b) measures are employed to repair the reputation of the organization.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-5 > Assessment Methods

IR-5 Incident Monitoring - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident monitoring

incident response records and documentation

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Incident monitoring capability for the organization

mechanisms supporting and/or implementing the tracking and documenting of system security incidents
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-5 > Assessment Objective

IR-5 Incident Monitoring - Assessment Objective
Determine if the following are satisfied:

IR-05[01] incidents are tracked;
IR-05[02] incidents are documented.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-5 > IR-5(1) > Assessment Methods

IR-5(1) Automated Tracking, Data Collection, and Analysis - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident monitoring

incident response records and documentation

system security plan

incident response plan

other relevant documents or records

Interview: Organizational personnel with incident monitoring responsibilities

organizational personnel with information security responsibilities

Test: Incident monitoring capability for the organization

automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-5 > IR-5(1) > Assessment Objective

IR-5(1) Automated Tracking, Data Collection, and Analysis - Assessment Objective
Determine if the following are satisfied:

IR-05(01)[01] incidents are tracked using [Assignment: organization-defined automated mechanisms];
IR-05(01)[02] incident information is collected using [Assignment: organization-defined automated mechanisms];
IR-05(01)[03] incident information is analyzed using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > Assessment Methods

IR-6 Incident Reporting - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident reporting

incident reporting records and documentation

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident reporting responsibilities

organizational personnel with information security and privacy responsibilities

personnel who have/should have reported incidents

personnel (authorities) to whom incident information is to be reported

system users

Test: Organizational processes for incident reporting

mechanisms supporting and/or implementing incident reporting
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-6 > Assessment Objective

IR-6 Incident Reporting - Assessment Objective
Determine if the following are satisfied:

IR-06a. personnel is/are required to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period];
IR-06b. incident information is reported to [Assignment: organization-defined authorities].