ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
AC > AC-6 > AC-6(10)

AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
Family: Access Control (AC) > AC-6 Least Privilege

Prevent non-privileged users from executing privileged functions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7

AC-7 Unsuccessful Logon Attempts
Family: Access Control (AC)

a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period] ; and
b. Automatically [Selection; one or more: lock the account or node for [Assignment: organization-defined time period] ; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm] ; notify system administrator; take other [Assignment: organization-defined action] ] when the maximum number of unsuccessful attempts is exceeded.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7 > Discussion

AC-7 Unsuccessful Logon Attempts - Discussion
Family: Access Control (AC)

The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. If a delay algorithm is selected, organizations may employ different algorithms for different components of the system based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels. Organization-defined actions that may be taken when the number of allowed consecutive invalid logon attempts is exceeded include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles such as location, time of day, IP address, device, or Media Access Control (MAC) address. If automatic system lockout or execution of a delay algorithm is not implemented in support of the availability objective, organizations consider a combination of other actions to help prevent brute force attacks. In addition to the above, organizations can prompt users to respond to a secret question before the number of allowed unsuccessful logon attempts is exceeded. Automatically unlocking an account after a specified period of time is generally not permitted. However, exceptions may be required based on operational mission or need.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7 > AC-7(2) > Discussion

AC-7(2) Purge or Wipe Mobile Device - Discussion
Family: Access Control (AC) > AC-7 Unsuccessful Logon Attempts

A mobile device is a computing device that has a small form factor such that it can be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Purging or wiping the device applies only to mobile devices for which the organization-defined number of unsuccessful logons occurs. The logon is to the mobile device, not to any one account on the device. Successful logons to accounts on mobile devices reset the unsuccessful logon count to zero. Purging or wiping may be unnecessary if the information on the device is protected with sufficiently strong encryption mechanisms.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7 > AC-7(2)

AC-7(2) Unsuccessful Logon Attempts | Purge or Wipe Mobile Device
Family: Access Control (AC) > AC-7 Unsuccessful Logon Attempts

Purge or wipe information from [Assignment: organization-defined mobile devices] based on [Assignment: organization-defined purging or wiping requirements and techniques] after [Assignment: organization-defined number] consecutive, unsuccessful device logon attempts.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7 > AC-7(3) > Discussion

AC-7(3) Biometric Attempt Limiting - Discussion
Family: Access Control (AC) > AC-7 Unsuccessful Logon Attempts

Biometrics are probabilistic in nature. The ability to successfully authenticate can be impacted by many factors, including matching performance and presentation attack detection mechanisms. Organizations select the appropriate number of attempts for users based on organizationally-defined factors.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7 > AC-7(3)

AC-7(3) Unsuccessful Logon Attempts | Biometric Attempt Limiting
Family: Access Control (AC) > AC-7 Unsuccessful Logon Attempts

Limit the number of unsuccessful biometric logon attempts to [Assignment: organization-defined number].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7 > AC-7(4) > Discussion

AC-7(4) Use of Alternate Authentication Factor - Discussion
Family: Access Control (AC) > AC-7 Unsuccessful Logon Attempts

The use of alternate authentication factors supports the objective of availability and allows a user who has inadvertently been locked out to use additional authentication factors to bypass the lockout.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-7 > AC-7(4)

AC-7(4) Unsuccessful Logon Attempts | Use of Alternate Authentication Factor
Family: Access Control (AC) > AC-7 Unsuccessful Logon Attempts

(a) Allow the use of [Assignment: organization-defined authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and
(b) Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts through use of the alternative factors by a user during a [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-8

AC-8 System Use Notification
Family: Access Control (AC)

a. Display [Assignment: organization-defined system use notification] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:
1. Users are accessing a U.S. Government system;
2. System usage may be monitored, recorded, and subject to audit;
3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
4. Use of the system indicates consent to monitoring and recording;
b. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and
c. For publicly accessible systems:
1. Display system use information [Assignment: organization-defined conditions] , before granting further access to the publicly accessible system;
2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
3. Include a description of the authorized uses of the system.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-8 > Discussion

AC-8 System Use Notification - Discussion
Family: Access Control (AC)

System use notifications can be implemented using messages or warning banners displayed before individuals log in to systems. System use notifications are used only for access via logon interfaces with human users. Notifications are not required when human interfaces do not exist. Based on an assessment of risk, organizations consider whether or not a secondary system use notification is needed to access applications or other system resources after the initial network logon. Organizations consider system use notification messages or banners displayed in multiple languages based on organizational needs and the demographics of system users. Organizations consult with the privacy office for input regarding privacy messaging and the Office of the General Counsel or organizational equivalent for legal review and approval of warning banner content.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9

AC-9 Previous Logon Notification
Family: Access Control (AC)

Notify the user, upon successful logon to the system, of the date and time of the last logon.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > Discussion

AC-9 Previous Logon Notification - Discussion
Family: Access Control (AC)

Previous logon notification is applicable to system access via human user interfaces and access to systems that occurs in other types of architectures. Information about the last successful logon allows the user to recognize if the date and time provided is not consistent with the user's last access.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(1) > Discussion

AC-9(1) Unsuccessful Logons - Discussion
Family: Access Control (AC) > AC-9 Previous Logon Notification

Information about the number of unsuccessful logon attempts since the last successful logon allows the user to recognize if the number of unsuccessful logon attempts is consistent with the user's actual logon attempts.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(1)

AC-9(1) Previous Logon Notification | Unsuccessful Logons
Family: Access Control (AC) > AC-9 Previous Logon Notification

Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(2) > Discussion

AC-9(2) Successful and Unsuccessful Logons - Discussion
Family: Access Control (AC) > AC-9 Previous Logon Notification

Information about the number of successful and unsuccessful logon attempts within a specified time period allows the user to recognize if the number and type of logon attempts are consistent with the user's actual logon attempts.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(2)

AC-9(2) Previous Logon Notification | Successful and Unsuccessful Logons
Family: Access Control (AC) > AC-9 Previous Logon Notification

Notify the user, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(3) > Discussion

AC-9(3) Notification of Account Changes - Discussion
Family: Access Control (AC) > AC-9 Previous Logon Notification

Information about changes to security-related account characteristics within a specified time period allows users to recognize if changes were made without their knowledge.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(3)

AC-9(3) Previous Logon Notification | Notification of Account Changes
Family: Access Control (AC) > AC-9 Previous Logon Notification

Notify the user, upon successful logon, of changes to [Assignment: organization-defined security-related characteristics or parameters] during [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(4) > Discussion

AC-9(4) Additional Logon Information - Discussion
Family: Access Control (AC) > AC-9 Previous Logon Notification

Organizations can specify additional information to be provided to users upon logon, including the location of the last logon. User location is defined as information that can be determined by systems, such as Internet Protocol (IP) addresses from which network logons occurred, notifications of local logons, or device identifiers.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-9 > AC-9(4)

AC-9(4) Previous Logon Notification | Additional Logon Information
Family: Access Control (AC) > AC-9 Previous Logon Notification

Notify the user, upon successful logon, of the following additional information: [Assignment: organization-defined additional information].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-10

AC-10 Concurrent Session Control
Family: Access Control (AC)

Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account types] to [Assignment: organization-defined number].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-10 > Discussion

AC-10 Concurrent Session Control - Discussion
Family: Access Control (AC)

Organizations may define the maximum number of concurrent sessions for system accounts globally, by account type, by account, or any combination thereof. For example, organizations may limit the number of concurrent sessions for system administrators or other individuals working in particularly sensitive domains or mission-critical applications. Concurrent session control addresses concurrent sessions for system accounts. It does not, however, address concurrent sessions by single users via multiple system accounts.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-11

AC-11 Device Lock
Family: Access Control (AC)

a. Prevent further access to the system by [Selection; one or more: initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended] ; and
b. Retain the device lock until the user reestablishes access using established identification and authentication procedures.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-11 > Discussion

AC-11 Device Lock - Discussion
Family: Access Control (AC)

Device locks are temporary actions taken to prevent logical access to organizational systems when users stop work and move away from the immediate vicinity of those systems but do not want to log out because of the temporary nature of their absences. Device locks can be implemented at the operating system level or at the application level. A proximity lock may be used to initiate the device lock (e.g., via a Bluetooth-enabled device or dongle). User-initiated device locking is behavior or policy-based and, as such, requires users to take physical action to initiate the device lock. Device locks are not an acceptable substitute for logging out of systems, such as when organizations require users to log out at the end of workdays.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-11 > AC-11(1) > Discussion

AC-11(1) Pattern-hiding Displays - Discussion
Family: Access Control (AC) > AC-11 Device Lock

The pattern-hiding display can include static or dynamic images, such as patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen with the caveat that controlled unclassified information is not displayed.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-11 > AC-11(1)

AC-11(1) Device Lock | Pattern-hiding Displays
Family: Access Control (AC) > AC-11 Device Lock

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12

AC-12 Session Termination
Family: Access Control (AC)

Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12 > Discussion

AC-12 Session Termination - Discussion
Family: Access Control (AC)

Session termination addresses the termination of user-initiated logical sessions (in contrast to [SC-10](#sc-10) , which addresses the termination of network connections associated with communications sessions (i.e., network disconnect)). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated without terminating network sessions. Session termination ends all processes associated with a user's logical session except for those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic termination of the session include organization-defined periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12 > AC-12(1) > Discussion

AC-12(1) User-initiated Logouts - Discussion
Family: Access Control (AC) > AC-12 Session Termination

Information resources to which users gain access via authentication include local workstations, databases, and password-protected websites or web-based services.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12 > AC-12(1)

AC-12(1) Session Termination | User-initiated Logouts
Family: Access Control (AC) > AC-12 Session Termination

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12 > AC-12(2) > Discussion

AC-12(2) Termination Message - Discussion
Family: Access Control (AC) > AC-12 Session Termination

Logout messages for web access can be displayed after authenticated sessions have been terminated. However, for certain types of sessions, including file transfer protocol (FTP) sessions, systems typically send logout messages as final messages prior to terminating sessions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12 > AC-12(2)

AC-12(2) Session Termination | Termination Message
Family: Access Control (AC) > AC-12 Session Termination

Display an explicit logout message to users indicating the termination of authenticated communications sessions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12 > AC-12(3) > Discussion

AC-12(3) Timeout Warning Message - Discussion
Family: Access Control (AC) > AC-12 Session Termination

To increase usability, notify users of pending session termination and prompt users to continue the session. The pending session termination time period is based on the parameters defined in the [AC-12](#ac-12) base control.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-12 > AC-12(3)

AC-12(3) Session Termination | Timeout Warning Message
Family: Access Control (AC) > AC-12 Session Termination

Display an explicit message to users indicating that the session will end in [Assignment: organization-defined time].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-14

AC-14 Permitted Actions Without Identification or Authentication
Family: Access Control (AC)

a. Identify [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and
b. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-14 > Discussion

AC-14 Permitted Actions Without Identification or Authentication - Discussion
Family: Access Control (AC)

Specific user actions may be permitted without identification or authentication if organizations determine that identification and authentication are not required for the specified user actions. Organizations may allow a limited number of user actions without identification or authentication, including when individuals access public websites or other publicly accessible federal systems, when individuals use mobile phones to receive calls, or when facsimiles are received. Organizations identify actions that normally require identification or authentication but may, under certain circumstances, allow identification or authentication mechanisms to be bypassed. Such bypasses may occur, for example, via a software-readable physical switch that commands bypass of the logon functionality and is protected from accidental or unmonitored use. Permitting actions without identification or authentication does not apply to situations where identification and authentication have already occurred and are not repeated but rather to situations where identification and authentication have not yet occurred. Organizations may decide that there are no user actions that can be performed on organizational systems without identification and authentication, and therefore, the value for the assignment operation can be "none."
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16

AC-16 Security and Privacy Attributes
Family: Access Control (AC)

a. Provide the means to associate [Assignment: organization-defined organization-defined types of security and privacy attributes] with [Assignment: organization-defined organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission;
b. Ensure that the attribute associations are made and retained with the information;
c. Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [Assignment: organization-defined organization-defined systems]: [Assignment: organization-defined organization-defined security and privacy attributes];
d. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges];
e. Audit changes to attributes; and
f. Review [Assignment: organization-defined organization-defined security and privacy attributes] for applicability [Assignment: organization-defined organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(1) > Discussion

AC-16(1) Dynamic Attribute Association - Discussion
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Dynamic association of attributes is appropriate whenever the security or privacy characteristics of information change over time. Attributes may change due to information aggregation issues (i.e., characteristics of individual data elements are different from the combined elements), changes in individual access authorizations (i.e., privileges), changes in the security category of information, or changes in security or privacy policies. Attributes may also change situationally.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-16 > AC-16(1)

AC-16(1) Security and Privacy Attributes | Dynamic Attribute Association
Family: Access Control (AC) > AC-16 Security and Privacy Attributes

Dynamically associate security and privacy attributes with [Assignment: organization-defined organization-defined subjects and objects] in accordance with the following security and privacy policies as information is created and combined: [Assignment: organization-defined organization-defined security and privacy policies].