ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-4 > AU-4(1) > Assessment Methods

AU-4(1) Transfer to Alternate Storage - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit storage capacity

procedures addressing transfer of system audit records to secondary or alternate systems

system design documentation

system configuration settings and associated documentation

logs of audit record transfers to secondary or alternate systems

system audit records transferred to secondary or alternate systems

other relevant documents or records

Interview: Organizational personnel with audit storage capacity planning responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Mechanisms supporting the transfer of audit records onto a different system
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-4 > AU-4(1) > Assessment Objective

AU-4(1) Transfer to Alternate Storage - Assessment Objective
Determine if the following are satisfied:

audit logs are transferred [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > Assessment Methods

AU-5 Response to Audit Logging Process Failures - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing response to audit processing failures

system design documentation

system security plan

privacy plan

system configuration settings and associated documentation

list of personnel to be notified in case of an audit processing failure

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing system response to audit processing failures
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > Assessment Objective

AU-5 Response to Audit Logging Process Failures - Assessment Objective
Determine if the following are satisfied:

AU-05a. [Assignment: organization-defined personnel or roles] are alerted in the event of an audit logging process failure within [Assignment: organization-defined time period];
AU-05b. [Assignment: organization-defined additional actions] are taken in the event of an audit logging process failure.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(1) > Assessment Methods

AU-5(1) Storage Capacity Warning - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing response to audit processing failures

system design documentation

system security plan

privacy system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing audit storage limit warnings
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(1) > Assessment Objective

AU-5(1) Storage Capacity Warning - Assessment Objective
Determine if the following are satisfied:

a warning is provided to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit log storage volume reaches [Assignment: organization-defined percentage] of repository maximum audit log storage capacity.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(2) > Assessment Methods

AU-5(2) Real-time Alerts - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing response to audit processing failures

system design documentation

system security plan

privacy plan

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(2) > Assessment Objective

AU-5(2) Real-time Alerts - Assessment Objective
Determine if the following are satisfied:

an alert is provided within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when [Assignment: organization-defined audit logging failure events requiring real-time alerts] occur.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(3) > Assessment Methods

AU-5(3) Configurable Traffic Volume Thresholds - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing response to audit processing failures

system design documentation

system security plan

privacy plan

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(3) > Assessment Objective

AU-5(3) Configurable Traffic Volume Thresholds - Assessment Objective
Determine if the following are satisfied:

AU-05(03)[01] configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity are enforced;
AU-05(03)[02] network traffic is [Selection; one or more: reject; delay] if network traffic volume is above configured thresholds.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(4) > Assessment Methods

AU-5(4) Shutdown on Failure - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing response to audit processing failures

system design documentation

system security plan

privacy plan

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: System capability invoking system shutdown or degraded operational mode in the event of an audit processing failure
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(4) > Assessment Objective

AU-5(4) Shutdown on Failure - Assessment Objective
Determine if the following are satisfied:

[Selection; one or more: full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] is/are invoked in the event of [Assignment: organization-defined audit logging failures] , unless an alternate audit logging capability exists.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(5) > Assessment Methods

AU-5(5) Alternate Audit Logging Capability - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing response to audit processing failures

system design documentation

system security plan

privacy plan

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Alternate audit logging capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-5 > AU-5(5) > Assessment Objective

AU-5(5) Alternate Audit Logging Capability - Assessment Objective
Determine if the following are satisfied:

an alternate audit logging capability is provided in the event of a failure in primary audit logging capability that implements [Assignment: organization-defined alternate audit logging functionality].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > Assessment Methods

AU-6 Audit Record Review, Analysis, and Reporting - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit review, analysis, and reporting

reports of audit findings

records of actions taken in response to reviews/analyses of audit records

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > Assessment Objective

AU-6 Audit Record Review, Analysis, and Reporting - Assessment Objective
Determine if the following are satisfied:

AU-06a. system audit records are reviewed and analyzed [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
AU-06b. findings are reported to [Assignment: organization-defined personnel or roles];
AU-06c. the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(1) > Assessment Methods

AU-6(1) Automated Process Integration - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit review, analysis, and reporting

procedures addressing investigation and response to suspicious activities

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms integrating audit review, analysis, and reporting processes
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(1) > Assessment Objective

AU-6(1) Automated Process Integration - Assessment Objective
Determine if the following are satisfied:

audit record review, analysis, and reporting processes are integrated using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(3) > Assessment Methods

AU-6(3) Correlate Audit Record Repositories - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit review, analysis, and reporting

system design documentation

system configuration settings and associated documentation

system audit records across different repositories

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting the analysis and correlation of audit records
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(3) > Assessment Objective

AU-6(3) Correlate Audit Record Repositories - Assessment Objective
Determine if the following are satisfied:

audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(4) > Assessment Methods

AU-6(4) Central Review and Analysis - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing audit review, analysis, and reporting

system design documentation

system configuration settings and associated documentation

system security plan

privacy plan

system audit records

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities

system developers

Test: System capability to centralize review and analysis of audit records
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(4) > Assessment Objective

AU-6(4) Central Review and Analysis - Assessment Objective
Determine if the following are satisfied:

AU-06(04)[01] the capability to centrally review and analyze audit records from multiple components within the system is provided;
AU-06(04)[02] the capability to centrally review and analyze audit records from multiple components within the system is implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(5) > Assessment Methods

AU-6(5) Integrated Analysis of Audit Records - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit review, analysis, and reporting

system design documentation

system configuration settings and associated documentation

integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information, and associated documentation

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing the capability to integrate analysis of audit records with analysis of data/information sources
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(5) > Assessment Objective

AU-6(5) Integrated Analysis of Audit Records - Assessment Objective
Determine if the following are satisfied:

analysis of audit records is integrated with analysis of [Selection; one or more: vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources] ] to further enhance the ability to identify inappropriate or unusual activity.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(6) > Assessment Methods

AU-6(6) Correlation with Physical Monitoring - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing audit review, analysis, and reporting

procedures addressing physical access monitoring

system design documentation

system configuration settings and associated documentation

documentation providing evidence of correlated information obtained from audit records and physical access monitoring records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with physical access monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing the capability to correlate information from audit records with information from monitoring physical access
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(6) > Assessment Objective

AU-6(6) Correlation with Physical Monitoring - Assessment Objective
Determine if the following are satisfied:

information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(7) > Assessment Methods

AU-6(7) Permitted Actions - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing process, role and/or user permitted actions from audit review, analysis, and reporting

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting permitted actions for the review, analysis, and reporting of audit information
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(7) > Assessment Objective

AU-6(7) Permitted Actions - Assessment Objective
Determine if the following are satisfied:

the permitted actions for each [Selection; one or more: system process; role; user] associated with the review, analysis, and reporting of audit record information are specified.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(8) > Assessment Methods

AU-6(8) Full Text Analysis of Privileged Commands - Assessment Methods and Objects

Examine: Audit and accountability policy

procedures addressing audit review, analysis, and reporting

system design documentation

system configuration settings and associated documentation

text analysis tools and techniques

text analysis documentation of audited privileged commands

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing the capability to perform a full text analysis of audited privilege commands
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(8) > Assessment Objective

AU-6(8) Full Text Analysis of Privileged Commands - Assessment Objective
Determine if the following are satisfied:

a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system or other system that is dedicated to that analysis is performed.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(9) > Assessment Methods

AU-6(9) Correlation with Information from Nontechnical Sources - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit review, analysis, and reporting

system design documentation

system configuration settings and associated documentation

documentation providing evidence of correlated information obtained from audit records and organization-defined non-technical sources

list of information types from non-technical sources for correlation with audit information

other relevant documents or records

Interview: Organizational personnel with audit review, analysis, and reporting responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing capability to correlate information from non-technical sources
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-6 > AU-6(9) > Assessment Objective

AU-6(9) Correlation with Information from Nontechnical Sources - Assessment Objective
Determine if the following are satisfied:

information from non-technical sources is correlated with audit record information to enhance organization-wide situational awareness.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-7 > Assessment Methods

AU-7 Audit Record Reduction and Report Generation - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit reduction and report generation

system design documentation

system configuration settings and associated documentation

audit reduction, review, analysis, and reporting tools

system audit records

other relevant documents or records

Interview: Organizational personnel with audit reduction and report generation responsibilities

organizational personnel with information security and privacy responsibilities

Test: Audit reduction and report generation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-7 > Assessment Objective

AU-7 Audit Record Reduction and Report Generation - Assessment Objective
Determine if the following are satisfied:

AU-07a.[01] an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;
AU-07a.[02] an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;
AU-07b.[01] an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records;
AU-07b.[02] an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-7 > AU-7(1) > Assessment Methods

AU-7(1) Automatic Processing - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit reduction and report generation

system design documentation

system configuration settings and associated documentation

audit reduction, review, analysis, and reporting tools

audit record criteria (fields) establishing events of interest

system audit records

other relevant documents or records

Interview: Organizational personnel with audit reduction and report generation responsibilities

organizational personnel with information security and privacy responsibilities

system developers

Test: Audit reduction and report generation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-7 > AU-7(1) > Assessment Objective

AU-7(1) Automatic Processing - Assessment Objective
Determine if the following are satisfied:

AU-07(01)[01] the capability to process, sort, and search audit records for events of interest based on [Assignment: organization-defined fields within audit records] are provided;
AU-07(01)[02] the capability to process, sort, and search audit records for events of interest based on [Assignment: organization-defined fields within audit records] are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-8 > Assessment Methods

AU-8 Time Stamps - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing timestamp generation

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing timestamp generation