ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(1) > Assessment Objective

MA-5(1) Individuals Without Appropriate Access - Assessment Objective
Determine if the following are satisfied:

MA-05(01)(a)(01) procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified escorting and supervising maintenance personnel without the needed access authorization during the performance of maintenance and diagnostic activities;
MA-05(01)(a)(02) procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include all volatile information storage components within the system being sanitized and all non-volatile storage media being removed or physically disconnected from the system and secured prior to initiating maintenance or diagnostic activities;
MA-05(01)(b) [Assignment: organization-defined alternate controls] are developed and implemented in the event that a system cannot be sanitized, removed, or disconnected from the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(2) > Assessment Methods

MA-5(2) Security Clearances for Classified Systems - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing maintenance personnel

personnel records

maintenance records

access control records

access credentials

access authorizations

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with personnel security responsibilities

organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for managing security clearances for maintenance personnel
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(2) > Assessment Objective

MA-5(2) Security Clearances for Classified Systems - Assessment Objective
Determine if the following are satisfied:

MA-05(02)[01] personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances for at least the highest classification level and for compartments of information on the system;
MA-05(02)[02] personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess formal access approvals for at least the highest classification level and for compartments of information on the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(3) > Assessment Methods

MA-5(3) Citizenship Requirements for Classified Systems - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing maintenance personnel

personnel records

maintenance records

access control records

access credentials

access authorizations

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(3) > Assessment Objective

MA-5(3) Citizenship Requirements for Classified Systems - Assessment Objective
Determine if the following are satisfied:

personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(4) > Assessment Methods

MA-5(4) Foreign Nationals - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing maintenance personnel

system media protection policy

access control policy and procedures

physical and environmental protection policy and procedures

memorandum of agreement

maintenance records

access control records

access credentials

access authorizations

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities, organizational personnel with personnel security responsibilities

organizational personnel managing memoranda of agreements

organizational personnel with information security responsibilities

Test: Organizational processes for managing foreign national maintenance personnel
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(4) > Assessment Objective

MA-5(4) Foreign Nationals - Assessment Objective
Determine if the following are satisfied:

MA-05(04)(a) foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments or owned and operated solely by foreign allied governments;
MA-05(04)(b)[01] approvals regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements;
MA-05(04)(b)[02] consents regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements;
MA-05(04)(b)[03] detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(5) > Assessment Methods

MA-5(5) Non-system Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing maintenance personnel

system media protection policy

access control policy and procedures

physical and environmental protection policy and procedures

maintenance records

access control records

access authorizations

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with personnel security responsibilities

organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-5 > MA-5(5) > Assessment Objective

MA-5(5) Non-system Maintenance - Assessment Objective
Determine if the following are satisfied:

non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system have required access authorizations.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > Assessment Methods

MA-6 Timely Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance

service provider contracts

service-level agreements

inventory and availability of spare parts

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with acquisition responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for ensuring timely maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > Assessment Objective

MA-6 Timely Maintenance - Assessment Objective
Determine if the following are satisfied:

maintenance support and/or spare parts are obtained for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure.
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > MA-6(1) > Assessment Methods

MA-6(1) Preventive Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance

service provider contracts

service-level agreements

maintenance records

list of system components requiring preventive maintenance

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for preventive maintenance

mechanisms supporting and/or implementing preventive maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > MA-6(1) > Assessment Objective

MA-6(1) Preventive Maintenance - Assessment Objective
Determine if the following are satisfied:

preventive maintenance is performed on [Assignment: organization-defined system components] at [Assignment: organization-defined time intervals].
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > MA-6(2) > Assessment Methods

MA-6(2) Predictive Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance

service provider contracts

service-level agreements

maintenance records

list of system components requiring predictive maintenance

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for predictive maintenance

mechanisms supporting and/or implementing predictive maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > MA-6(2) > Assessment Objective

MA-6(2) Predictive Maintenance - Assessment Objective
Determine if the following are satisfied:

predictive maintenance is performed on [Assignment: organization-defined system components] at [Assignment: organization-defined time intervals].
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > MA-6(3) > Assessment Methods

MA-6(3) Automated Support for Predictive Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing system maintenance

service provider contracts

service-level agreements

maintenance records

list of system components requiring predictive maintenance

system security plan

other relevant documents or records

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Automated mechanisms implementing the transfer of predictive maintenance data to a computerized maintenance management system

operations of the computer maintenance management system
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-6 > MA-6(3) > Assessment Objective

MA-6(3) Automated Support for Predictive Maintenance - Assessment Objective
Determine if the following are satisfied:

predictive maintenance data is transferred to a maintenance management system using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-7 > Assessment Methods

MA-7 Field Maintenance - Assessment Methods and Objects

Examine: Maintenance policy

procedures addressing field maintenance

system design documentation

system configuration settings and associated documentation

maintenance records

diagnostic records

system security plan

other relevant documents or records.

Interview: Organizational personnel with system maintenance responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing field maintenance

mechanisms implementing, supporting, and/or managing field maintenance

mechanisms for strong authentication of field maintenance diagnostic sessions

mechanisms for terminating field maintenance sessions and network connections
Assessing Security and Privacy Controls in Information Systems and Organizations
MA > MA-7 > Assessment Objective

MA-7 Field Maintenance - Assessment Objective
Determine if the following are satisfied:

field maintenance on [Assignment: organization-defined systems or system components] are restricted or prohibited to [Assignment: organization-defined trusted maintenance facilities].
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-1 > Assessment Methods

MP-1 Policy and Procedures - Assessment Methods and Objects

Examine: Media protection policy and procedures

organizational risk management strategy

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with media protection responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-1 > Assessment Objective

MP-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

MP-01a.[01] a media protection policy is developed and documented;
MP-01a.[02] the media protection policy is disseminated to [Assignment: organization-defined personnel or roles];
MP-01a.[03] media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented;
MP-01a.[04] the media protection procedures are disseminated to [Assignment: organization-defined personnel or roles];
MP-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] media protection policy addresses purpose;
MP-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] media protection policy addresses scope;
MP-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] media protection policy addresses roles;
MP-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] media protection policy addresses responsibilities;
MP-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] media protection policy addresses management commitment;
MP-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] media protection policy addresses coordination among organizational entities;
MP-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] media protection policy compliance;
MP-01a.01(b) the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
MP-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.
MP-01c.01[01] the current media protection policy is reviewed and updated [Assignment: organization-defined frequency];
MP-01c.01[02] the current media protection policy is reviewed and updated following [Assignment: organization-defined events];
MP-01c.02[01] the current media protection procedures are reviewed and updated [Assignment: organization-defined frequency];
MP-01c.02[02] the current media protection procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-2 > Assessment Methods

MP-2 Media Access - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media access restrictions

access control policy and procedures

physical and environmental protection policy and procedures

media storage facilities

access control records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media protection responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for restricting information media

mechanisms supporting and/or implementing media access restrictions
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-2 > Assessment Objective

MP-2 Media Access - Assessment Objective
Determine if the following are satisfied:

MP-02[01] access to [Assignment: organization-defined types of digital media] is restricted to [Assignment: organization-defined personnel or roles];
MP-02[02] access to [Assignment: organization-defined types of non-digital media] is restricted to [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-3 > Assessment Methods

MP-3 Media Marking - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media marking

physical and environmental protection policy and procedures

list of system media marking security attributes

designated controlled areas

system security plan

other relevant documents or records

Interview: Organizational personnel with system media protection and marking responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for marking information media

mechanisms supporting and/or implementing media marking
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-3 > Assessment Objective

MP-3 Media Marking - Assessment Objective
Determine if the following are satisfied:

MP-03a. system media is marked to indicate distribution limitations, handling caveats, and applicable security markings (if any) of the information;
MP-03b. [Assignment: organization-defined types of media exempted from marking] remain within [Assignment: organization-defined controlled areas].
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-4 > Assessment Methods

MP-4 Media Storage - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media storage

physical and environmental protection policy and procedures

access control policy and procedures

system media

designated controlled areas

system security plan

other relevant documents or records

Interview: Organizational personnel with system media protection and storage responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for storing information media

mechanisms supporting and/or implementing secure media storage/media protection
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-4 > Assessment Objective

MP-4 Media Storage - Assessment Objective
Determine if the following are satisfied:

MP-04a.[01] [Assignment: organization-defined types of digital media] are physically controlled;
MP-04a.[02] [Assignment: organization-defined types of non-digital media] are physically controlled;
MP-04a.[03] [Assignment: organization-defined types of digital media] are securely stored within [Assignment: organization-defined controlled areas];
MP-04a.[04] [Assignment: organization-defined types of non-digital media] are securely stored within [Assignment: organization-defined controlled areas];
MP-04b. system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-4 > MP-4(2) > Assessment Methods

MP-4(2) Automated Restricted Access - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media storage

access control policy and procedures

physical and environmental protection policy and procedures

system design documentation

system configuration settings and associated documentation

media storage facilities

access control devices

access control records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media protection and storage responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Automated mechanisms restricting access to media storage areas

automated mechanisms auditing access attempts and access granted to media storage areas
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-4 > MP-4(2) > Assessment Objective

MP-4(2) Automated Restricted Access - Assessment Objective
Determine if the following are satisfied:

MP-04(02)[01] access to media storage areas is restricted using [Assignment: organization-defined automated mechanisms];
MP-04(02)[02] access attempts to media storage areas are logged using [Assignment: organization-defined automated mechanisms];
MP-04(02)[03] access granted to media storage areas is logged using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-5 > Assessment Methods

MP-5 Media Transport - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media storage

physical and environmental protection policy and procedures

access control policy and procedures

authorized personnel list

system media

designated controlled areas

system security plan

other relevant documents or records

Interview: Organizational personnel with system media protection and storage responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for storing information media

mechanisms supporting and/or implementing media storage/media protection
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-5 > Assessment Objective

MP-5 Media Transport - Assessment Objective
Determine if the following are satisfied:

MP-05a.[01] [Assignment: organization-defined types of system media] are protected during transport outside of controlled areas using [Assignment: organization-defined controls];
MP-05a.[02] [Assignment: organization-defined types of system media] are controlled during transport outside of controlled areas using [Assignment: organization-defined controls];
MP-05b. accountability for system media is maintained during transport outside of controlled areas;
MP-05c. activities associated with the transport of system media are documented;
MP-05d.[01] personnel authorized to conduct media transport activities is/are identified;
MP-05d.[02] activities associated with the transport of system media are restricted to identified authorized personnel.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-5 > MP-5(3) > Assessment Methods

MP-5(3) Custodians - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media transport

physical and environmental protection policy and procedures

system media transport records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media transport responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for identifying and employing a custodian to transport media outside of controlled areas