ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7

CA-7 Continuous Monitoring
Family: Assessment, Authorization, and Monitoring (CA)

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:
a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];
b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness;
c. Ongoing control assessments in accordance with the continuous monitoring strategy;
d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
e. Correlation and analysis of information generated by control assessments and monitoring;
f. Response actions to address results of the analysis of control assessment and monitoring information; and
g. Reporting the security and privacy status of the system to [Assignment: organization-defined organization-defined personnel or roles] [Assignment: organization-defined organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > Discussion

CA-7 Continuous Monitoring - Discussion
Family: Assessment, Authorization, and Monitoring (CA)

Continuous monitoring at the system level facilitates ongoing awareness of the system security and privacy posture to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring generate risk response actions by organizations. When monitoring the effectiveness of multiple controls that have been grouped into capabilities, a root-cause analysis may be needed to determine the specific control that has failed. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security and privacy information on a continuing basis through reports and dashboards gives organizational officials the ability to make effective and timely risk management decisions, including ongoing authorization decisions.

Automation supports more frequent updates to hardware, software, and firmware inventories, authorization packages, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of systems. Monitoring requirements, including the need for specific monitoring, may be referenced in other controls and control enhancements, such as [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PM-31](#pm-31), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SR-4](#sr-4), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) , and [SI-4](#si-4).
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(1) > Discussion

CA-7(1) Independent Assessment - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Organizations maximize the value of control assessments by requiring that assessments be conducted by assessors with appropriate levels of independence. The level of required independence is based on organizational continuous monitoring strategies. Assessor independence provides a degree of impartiality to the monitoring process. To achieve such impartiality, assessors do not create a mutual or conflicting interest with the organizations where the assessments are being conducted, assess their own work, act as management or employees of the organizations they are serving, or place themselves in advocacy positions for the organizations acquiring their services.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(1)

CA-7(1) Continuous Monitoring | Independent Assessment
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(3) > Discussion

CA-7(3) Trend Analyses - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Trend analyses include examining recent threat information that addresses the types of threat events that have occurred in the organization or the Federal Government, success rates of certain types of attacks, emerging vulnerabilities in technologies, evolving social engineering techniques, the effectiveness of configuration settings, results from multiple control assessments, and findings from Inspectors General or auditors.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(3)

CA-7(3) Continuous Monitoring | Trend Analyses
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(4) > Discussion

CA-7(4) Risk Monitoring - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Risk monitoring is informed by the established organizational risk tolerance. Effectiveness monitoring determines the ongoing effectiveness of the implemented risk response measures. Compliance monitoring verifies that required risk response measures are implemented. It also verifies that security and privacy requirements are satisfied. Change monitoring identifies changes to organizational systems and environments of operation that may affect security and privacy risk.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(4)

CA-7(4) Continuous Monitoring | Risk Monitoring
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:
(a) Effectiveness monitoring;
(b) Compliance monitoring; and
(c) Change monitoring.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(5) > Discussion

CA-7(5) Consistency Analysis - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Security and privacy controls are often added incrementally to a system. As a result, policies for selecting and implementing controls may be inconsistent, and the controls could fail to work together in a consistent or coordinated manner. At a minimum, the lack of consistency and coordination could mean that there are unacceptable security and privacy gaps in the system. At worst, it could mean that some of the controls implemented in one location or by one component are actually impeding the functionality of other controls (e.g., encrypting internal network traffic can impede monitoring). In other situations, failing to consistently monitor all implemented network protocols (e.g., a dual stack of IPv4 and IPv6) may create unintended vulnerabilities in the system that could be exploited by adversaries. It is important to validate-through testing, monitoring, and analysis-that the implemented controls are operating in a consistent, coordinated, non-interfering manner.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(5)

CA-7(5) Continuous Monitoring | Consistency Analysis
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [Assignment: organization-defined organization-defined actions].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(6) > Discussion

CA-7(6) Automation Support for Monitoring - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Using automated tools for monitoring helps to maintain the accuracy, currency, and availability of monitoring information which in turns helps to increase the level of ongoing awareness of the system security and privacy posture in support of organizational risk management decisions.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-7 > CA-7(6)

CA-7(6) Continuous Monitoring | Automation Support for Monitoring
Family: Assessment, Authorization, and Monitoring (CA) > CA-7 Continuous Monitoring

Ensure the accuracy, currency, and availability of monitoring results for the system using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8

CA-8 Penetration Testing
Family: Assessment, Authorization, and Monitoring (CA)

Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined system(s) or system components].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8 > Discussion

CA-8 Penetration Testing - Discussion
Family: Assessment, Authorization, and Monitoring (CA)

Penetration testing is a specialized type of assessment conducted on systems or individual system components to identify vulnerabilities that could be exploited by adversaries. Penetration testing goes beyond automated vulnerability scanning and is conducted by agents and teams with demonstrable skills and experience that include technical expertise in network, operating system, and/or application level security. Penetration testing can be used to validate vulnerabilities or determine the degree of penetration resistance of systems to adversaries within specified constraints. Such constraints include time, resources, and skills. Penetration testing attempts to duplicate the actions of adversaries and provides a more in-depth analysis of security- and privacy-related weaknesses or deficiencies. Penetration testing is especially important when organizations are transitioning from older technologies to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols).

Organizations can use the results of vulnerability analyses to support penetration testing activities. Penetration testing can be conducted internally or externally on the hardware, software, or firmware components of a system and can exercise both physical and technical controls. A standard method for penetration testing includes a pretest analysis based on full knowledge of the system, pretest identification of potential vulnerabilities based on the pretest analysis, and testing designed to determine the exploitability of vulnerabilities. All parties agree to the rules of engagement before commencing penetration testing scenarios. Organizations correlate the rules of engagement for the penetration tests with the tools, techniques, and procedures that are anticipated to be employed by adversaries. Penetration testing may result in the exposure of information that is protected by laws or regulations, to individuals conducting the testing. Rules of engagement, contracts, or other appropriate mechanisms can be used to communicate expectations for how to protect this information. Risk assessments guide the decisions on the level of independence required for the personnel conducting penetration testing.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8 > CA-8(1) > Discussion

CA-8(1) Independent Penetration Testing Agent or Team - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-8 Penetration Testing

Independent penetration testing agents or teams are individuals or groups who conduct impartial penetration testing of organizational systems. Impartiality implies that penetration testing agents or teams are free from perceived or actual conflicts of interest with respect to the development, operation, or management of the systems that are the targets of the penetration testing. [CA-2(1)](#ca-2.1) provides additional information on independent assessments that can be applied to penetration testing.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8 > CA-8(1)

CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team
Family: Assessment, Authorization, and Monitoring (CA) > CA-8 Penetration Testing

Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8 > CA-8(2) > Discussion

CA-8(2) Red Team Exercises - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-8 Penetration Testing

Red team exercises extend the objectives of penetration testing by examining the security and privacy posture of organizations and the capability to implement effective cyber defenses. Red team exercises simulate attempts by adversaries to compromise mission and business functions and provide a comprehensive assessment of the security and privacy posture of systems and organizations. Such attempts may include technology-based attacks and social engineering-based attacks. Technology-based attacks include interactions with hardware, software, or firmware components and/or mission and business processes. Social engineering-based attacks include interactions via email, telephone, shoulder surfing, or personal conversations. Red team exercises are most effective when conducted by penetration testing agents and teams with knowledge of and experience with current adversarial tactics, techniques, procedures, and tools. While penetration testing may be primarily laboratory-based testing, organizations can use red team exercises to provide more comprehensive assessments that reflect real-world conditions. The results from red team exercises can be used by organizations to improve security and privacy awareness and training and to assess control effectiveness.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8 > CA-8(2)

CA-8(2) Penetration Testing | Red Team Exercises
Family: Assessment, Authorization, and Monitoring (CA) > CA-8 Penetration Testing

Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises].
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8 > CA-8(3) > Discussion

CA-8(3) Facility Penetration Testing - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-8 Penetration Testing

Penetration testing of physical access points can provide information on critical vulnerabilities in the operating environments of organizational systems. Such information can be used to correct weaknesses or deficiencies in physical controls that are necessary to protect organizational systems.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-8 > CA-8(3)

CA-8(3) Penetration Testing | Facility Penetration Testing
Family: Assessment, Authorization, and Monitoring (CA) > CA-8 Penetration Testing

Employ a penetration testing process that includes [Assignment: organization-defined frequency] [Selection; one or more: announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-9

CA-9 Internal System Connections
Family: Assessment, Authorization, and Monitoring (CA)

a. Authorize internal connections of [Assignment: organization-defined system components] to the system;
b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;
c. Terminate internal system connections after [Assignment: organization-defined conditions] ; and
d. Review [Assignment: organization-defined frequency] the continued need for each internal connection.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-9 > Discussion

CA-9 Internal System Connections - Discussion
Family: Assessment, Authorization, and Monitoring (CA)

Internal system connections are connections between organizational systems and separate constituent system components (i.e., connections between components that are part of the same system) including components used for system development. Intra-system connections include connections with mobile devices, notebook and desktop computers, tablets, printers, copiers, facsimile machines, scanners, sensors, and servers. Instead of authorizing each internal system connection individually, organizations can authorize internal connections for a class of system components with common characteristics and/or configurations, including printers, scanners, and copiers with a specified processing, transmission, and storage capability or smart phones and tablets with a specific baseline configuration. The continued need for an internal system connection is reviewed from the perspective of whether it provides support for organizational missions or business functions.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-9 > CA-9(1) > Discussion

CA-9(1) Compliance Checks - Discussion
Family: Assessment, Authorization, and Monitoring (CA) > CA-9 Internal System Connections

Compliance checks include verification of the relevant baseline configuration.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-9 > CA-9(1)

CA-9(1) Internal System Connections | Compliance Checks
Family: Assessment, Authorization, and Monitoring (CA) > CA-9 Internal System Connections

Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-1

CM-1 Policy and Procedures
Family: Configuration Management (CM)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] configuration management policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the configuration management policy and procedures; and
c. Review and update the current configuration management:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-1 > Discussion

CM-1 Policy and Procedures - Discussion
Family: Configuration Management (CM)

Configuration management policy and procedures address the controls in the CM family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of configuration management policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission/business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to configuration management policy and procedures include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2

CM-2 Baseline Configuration
Family: Configuration Management (CM)

a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
b. Review and update the baseline configuration of the system:
1. [Assignment: organization-defined frequency];
2. When required due to [Assignment: organization-defined circumstances] ; and
3. When system components are installed or upgraded.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > Discussion

CM-2 Baseline Configuration - Discussion
Family: Configuration Management (CM)

Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.