ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-8 > SC-8(5) > Assessment Objective

SC-8(5) Protected Distribution System - Assessment Objective
Determine if the following are satisfied:

the [Assignment: organization-defined protected distribution system] is implemented to [Selection; one or more: prevent unauthorized disclosure of information; detect changes to information] during transmission.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-10 > Assessment Methods

SC-10 Network Disconnect - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing network disconnect

system design documentation

security plan

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing a network disconnect capability
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-10 > Assessment Objective

SC-10 Network Disconnect - Assessment Objective
Determine if the following are satisfied:

the network connection associated with a communication session is terminated at the end of the session or after [Assignment: organization-defined time period] of inactivity.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-11 > Assessment Methods

SC-11 Trusted Path - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing trusted communication paths

security plan

system design documentation

system configuration settings and associated documentation

assessment results from independent, testing organizations

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing trusted communication paths
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-11 > Assessment Objective

SC-11 Trusted Path - Assessment Objective
Determine if the following are satisfied:

SC-11a. a [Selection: physically; logically] isolated trusted communication path is provided for communications between the user and the trusted components of the system;
SC-11b. users are permitted to invoke the trusted communication path for communications between the user and the [Assignment: organization-defined security functions] of the system, including authentication and re-authentication, at a minimum.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-11 > SC-11(1) > Assessment Methods

SC-11(1) Irrefutable Communications Path - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing trusted communication paths

security plan

system design documentation

system configuration settings and associated documentation

assessment results from independent, testing organizations

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing trusted communication paths
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-11 > SC-11(1) > Assessment Objective

SC-11(1) Irrefutable Communications Path - Assessment Objective
Determine if the following are satisfied:

SC-11(01)(a) a trusted communication path that is irrefutably distinguishable from other communication paths is provided;
SC-11(01)(b) the trusted communication path for communications between the [Assignment: organization-defined security functions] of the system and the user is initiated.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > Assessment Methods

SC-12 Cryptographic Key Establishment and Management - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cryptographic key establishment and management

system design documentation

cryptographic mechanisms

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for cryptographic key establishment and/or management

Test: Mechanisms supporting and/or implementing cryptographic key establishment and management
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > Assessment Objective

SC-12 Cryptographic Key Establishment and Management - Assessment Objective
Determine if the following are satisfied:

SC-12[01] cryptographic keys are established when cryptography is employed within the system in accordance with [Assignment: organization-defined requirements];
SC-12[02] cryptographic keys are managed when cryptography is employed within the system in accordance with [Assignment: organization-defined requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(1) > Assessment Methods

SC-12(1) Availability - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cryptographic key establishment, management, and recovery

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for cryptographic key establishment or management

Test: Mechanisms supporting and/or implementing cryptographic key establishment and management
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(1) > Assessment Objective

SC-12(1) Availability - Assessment Objective
Determine if the following are satisfied:

information availability is maintained in the event of the loss of cryptographic keys by users.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(2) > Assessment Methods

SC-12(2) Symmetric Keys - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cryptographic key establishment and management

system design documentation

system configuration settings and associated documentation

system audit records

list of FIPS-validated cryptographic products

list of NSA-approved cryptographic products

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for cryptographic key establishment or management

Test: Mechanisms supporting and/or implementing symmetric cryptographic key establishment and management
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(2) > Assessment Objective

SC-12(2) Symmetric Keys - Assessment Objective
Determine if the following are satisfied:

SC-12(02)[01] symmetric cryptographic keys are produced using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes;
SC-12(02)[02] symmetric cryptographic keys are controlled using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes;
SC-12(02)[03] symmetric cryptographic keys are distributed using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(3) > Assessment Methods

SC-12(3) Asymmetric Keys - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cryptographic key establishment and management

system design documentation

system configuration settings and associated documentation

system audit records

list of NSA-approved cryptographic products

list of approved PKI Class 3 and Class 4 certificates

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for cryptographic key establishment or management

organizational personnel with responsibilities for PKI certificates

Test: Mechanisms supporting and/or implementing asymmetric cryptographic key establishment and management
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(3) > Assessment Objective

SC-12(3) Asymmetric Keys - Assessment Objective
Determine if the following are satisfied:

SC-12(03)[01] asymmetric cryptographic keys are produced using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; certificates issued in accordance with organization-defined requirements];
SC-12(03)[02] asymmetric cryptographic keys are controlled using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; certificates issued in accordance with organization-defined requirements];
SC-12(03)[03] asymmetric cryptographic keys are distributed using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; certificates issued in accordance with organization-defined requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(6) > Assessment Methods

SC-12(6) Physical Control of Keys - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cryptographic key establishment, management, and recovery

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for cryptographic key establishment or management

Test: Mechanisms supporting and/or implementing cryptographic key establishment and management
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-12 > SC-12(6) > Assessment Objective

SC-12(6) Physical Control of Keys - Assessment Objective
Determine if the following are satisfied:

physical control of cryptographic keys is maintained when stored information is encrypted by external service providers.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-13 > Assessment Methods

SC-13 Cryptographic Protection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cryptographic protection

system design documentation

system configuration settings and associated documentation

cryptographic module validation certificates

list of FIPS-validated cryptographic modules

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for cryptographic protection

Test: Mechanisms supporting and/or implementing cryptographic protection
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-13 > Assessment Objective

SC-13 Cryptographic Protection - Assessment Objective
Determine if the following are satisfied:

SC-13a. [Assignment: organization-defined cryptographic uses] are identified;
SC-13b. [Assignment: organization-defined types of cryptography] for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > Assessment Methods

SC-15 Collaborative Computing Devices and Applications - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing collaborative computing

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing collaborative computing devices

Test: Mechanisms supporting and/or implementing the management of remote activation of collaborative computing devices

mechanisms providing an indication of use of collaborative computing devices
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > Assessment Objective

SC-15 Collaborative Computing Devices and Applications - Assessment Objective
Determine if the following are satisfied:

SC-15a. remote activation of collaborative computing devices and applications is prohibited except [Assignment: organization-defined exceptions where remote activation is to be allowed];
SC-15b. an explicit indication of use is provided to users physically present at the devices.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > SC-15(1) > Assessment Methods

SC-15(1) Physical or Logical Disconnect - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing collaborative computing

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing collaborative computing devices

Test: Mechanisms supporting and/or implementing the physical disconnect of collaborative computing devices
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > SC-15(1) > Assessment Objective

SC-15(1) Physical or Logical Disconnect - Assessment Objective
Determine if the following are satisfied:

the [Selection; one or more: physical; logical] disconnect of collaborative computing devices is/are provided in a manner that supports ease of use.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > SC-15(3) > Assessment Methods

SC-15(3) Disabling and Removal in Secure Work Areas - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing collaborative computing

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

list of secure work areas

systems or system components in secured work areas where collaborative computing devices are to be disabled or removed

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing collaborative computing devices

Test: Mechanisms supporting and/or implementing the capability to disable collaborative computing devices
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > SC-15(3) > Assessment Objective

SC-15(3) Disabling and Removal in Secure Work Areas - Assessment Objective
Determine if the following are satisfied:

collaborative computing devices and applications are disabled or removed from [Assignment: organization-defined systems or system components] in [Assignment: organization-defined secure work areas].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > SC-15(4) > Assessment Methods

SC-15(4) Explicitly Indicate Current Participants - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing collaborative computing

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

list of types of meetings and teleconferences requiring explicit indication of current participants

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing collaborative computing devices

Test: Mechanisms supporting and/or implementing the capability to indicate participants on collaborative computing devices
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-15 > SC-15(4) > Assessment Objective

SC-15(4) Explicitly Indicate Current Participants - Assessment Objective
Determine if the following are satisfied:

an explicit indication of current participants in [Assignment: organization-defined online meetings and teleconferences] is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > Assessment Methods

SC-16 Transmission of Security and Privacy Attributes - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the transmission of security and privacy attributes

access control policy and procedures

information flow control policy

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting and/or implementing the transmission of security and privacy attributes between systems
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > Assessment Objective

SC-16 Transmission of Security and Privacy Attributes - Assessment Objective
Determine if the following are satisfied:

SC-16[01] [Assignment: organization-defined security attributes] are associated with information exchanged between systems;
SC-16[02] [Assignment: organization-defined security attributes] are associated with information exchanged between system components;
SC-16[03] [Assignment: organization-defined privacy attributes] are associated with information exchanged between systems;
SC-16[04] [Assignment: organization-defined privacy attributes] are associated with information exchanged between system components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > SC-16(1) > Assessment Methods

SC-16(1) Integrity Verification - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the transmission of security and privacy attributes

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting and/or implementing verification of the integrity of transmitted security and privacy attributes
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > SC-16(1) > Assessment Objective

SC-16(1) Integrity Verification - Assessment Objective
Determine if the following are satisfied:

SC-16(01)[01] the integrity of transmitted security attributes is verified;
SC-16(01)[02] the integrity of transmitted privacy attributes is verified.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > SC-16(2) > Assessment Methods

SC-16(2) Anti-spoofing Mechanisms - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the transmission of security and privacy attributes

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing anti-spoofing mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > SC-16(2) > Assessment Objective

SC-16(2) Anti-spoofing Mechanisms - Assessment Objective
Determine if the following are satisfied:

anti-spoofing mechanisms are implemented to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > SC-16(3) > Assessment Methods

SC-16(3) Cryptographic Binding - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the transmission of security and privacy attributes

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing anti-spoofing mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-16 > SC-16(3) > Assessment Objective

SC-16(3) Cryptographic Binding - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined mechanisms or techniques] are implemented to bind security and privacy attributes to transmitted information.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-17 > Assessment Methods

SC-17 Public Key Infrastructure Certificates - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing public key infrastructure certificates

public key certificate policy or policies

public key issuing process

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for issuing public key certificates

service providers

Test: Mechanisms supporting and/or implementing the management of public key infrastructure certificates