ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(4) > Assessment Objective

IA-4(4) Identify User Status - Assessment Objective
Determine if the following are satisfied:

individual identifiers are managed by uniquely identifying each individual as [Assignment: organization-defined characteristics].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(5) > Assessment Methods

IA-4(5) Dynamic Management - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing identifier management

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing dynamic identifier management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(5) > Assessment Objective

IA-4(5) Dynamic Management - Assessment Objective
Determine if the following are satisfied:

individual identifiers are dynamically managed in accordance with [Assignment: organization-defined dynamic identifier policy].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(6) > Assessment Methods

IA-4(6) Cross-organization Management - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identifier management

procedures addressing account management

system security plan

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing identifier management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(6) > Assessment Objective

IA-4(6) Cross-organization Management - Assessment Objective
Determine if the following are satisfied:

cross-organization management of identifiers is coordinated with [Assignment: organization-defined external organizations].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(8) > Assessment Methods

IA-4(8) Pairwise Pseudonymous Identifiers - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing identifier management

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing identifier management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(8) > Assessment Objective

IA-4(8) Pairwise Pseudonymous Identifiers - Assessment Objective
Determine if the following are satisfied:

pairwise pseudonymous identifiers are generated.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(9) > Assessment Methods

IA-4(9) Attribute Maintenance and Protection - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing identifier management

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing identifier management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(9) > Assessment Objective

IA-4(9) Attribute Maintenance and Protection - Assessment Objective
Determine if the following are satisfied:

the attributes for each uniquely identified individual, device, or service are maintained in [Assignment: organization-defined protected central storage].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > Assessment Methods

IA-5 Authenticator Management - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

addressing authenticator management

system design documentation

system configuration settings and associated documentation

list of system authenticator types

change control records associated with managing system authenticators

system audit records

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing authenticator management capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > Assessment Objective

IA-5 Authenticator Management - Assessment Objective
Determine if the following are satisfied:

IA-05a. system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution;
IA-05b. system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization;
IA-05c. system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use;
IA-05d. system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators;
IA-05e. system authenticators are managed through the change of default authenticators prior to first use;
IA-05f. system authenticators are managed through the change or refreshment of authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;
IA-05g. system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification;
IA-05h.[01] system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators;
IA-05h.[02] system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators;
IA-05i. system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(1) > Assessment Methods

IA-5(1) Password-based Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

password policy

procedures addressing authenticator management

system security plan

system design documentation

system configuration settings and associated documentation

password configurations and associated documentation

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing password-based authenticator management capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(1) > Assessment Objective

IA-5(1) Password-based Authentication - Assessment Objective
Determine if the following are satisfied:

IA-05(01)(a) for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
IA-05(01)(b) for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a);
IA-05(01)(c) for password-based authentication, passwords are only transmitted over cryptographically protected channels;
IA-05(01)(d) for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash;
IA-05(01)(e) for password-based authentication, immediate selection of a new password is required upon account recovery;
IA-05(01)(f) for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters;
IA-05(01)(g) for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators;
IA-05(01)(h) for password-based authentication, [Assignment: organization-defined composition and complexity rules] are enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(2) > Assessment Methods

IA-5(2) Public Key-based Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing authenticator management

system security plan

system design documentation

system configuration settings and associated documentation

PKI certification validation records

PKI certification revocation lists

other relevant documents or records

Interview: Organizational personnel with PKI-based, authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing PKI-based, authenticator management capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(2) > Assessment Objective

IA-5(2) Public Key-based Authentication - Assessment Objective
Determine if the following are satisfied:

IA-05(02)(a)(01) authorized access to the corresponding private key is enforced for public key-based authentication;
IA-05(02)(a)(02) the authenticated identity is mapped to the account of the individual or group for public key-based authentication;
IA-05(02)(b)(01) when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information;
IA-05(02)(b)(02) when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(5) > Assessment Methods

IA-5(5) Change Authenticators Prior to Delivery - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

system and services acquisition policy

procedures addressing authenticator management

procedures addressing the integration of security requirements into the acquisition process

acquisition documentation

acquisition contracts for system procurements or services

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security, acquisition, and contracting responsibilities

system developers

Test: Mechanisms supporting and/or implementing authenticator management capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(5) > Assessment Objective

IA-5(5) Change Authenticators Prior to Delivery - Assessment Objective
Determine if the following are satisfied:

developers and installers of system components are required to provide unique authenticators or change default authenticators prior to delivery and installation.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(6) > Assessment Methods

IA-5(6) Protection of Authenticators - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing authenticator management

security categorization documentation for the system

security assessments of authenticator protections

risk assessment results

system security plan

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel implementing and/or maintaining authenticator protections

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing authenticator management capability

mechanisms protecting authenticators
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(6) > Assessment Objective

IA-5(6) Protection of Authenticators - Assessment Objective
Determine if the following are satisfied:

authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(7) > Assessment Methods

IA-5(7) No Embedded Unencrypted Static Authenticators - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing authenticator management

system design documentation

system configuration settings and associated documentation

logical access scripts

application code reviews for detecting unencrypted static authenticators

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing authenticator management capability

mechanisms implementing authentication in applications
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(7) > Assessment Objective

IA-5(7) No Embedded Unencrypted Static Authenticators - Assessment Objective
Determine if the following are satisfied:

unencrypted static authenticators are not embedded in applications or other forms of static storage.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(8) > Assessment Methods

IA-5(8) Multiple System Accounts - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing authenticator management

system security plan

list of individuals having accounts on multiple systems

list of security safeguards intended to manage risk of compromise due to individuals having accounts on multiple systems

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing safeguards for authenticator management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(8) > Assessment Objective

IA-5(8) Multiple System Accounts - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined security controls] are implemented to manage the risk of compromise due to individuals having accounts on multiple systems.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(9) > Assessment Methods

IA-5(9) Federated Credential Management - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing authenticator management

procedures addressing account management

system security plan

security agreements

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing safeguards for authenticator management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(9) > Assessment Objective

IA-5(9) Federated Credential Management - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined external organizations] are used to federate credentials.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(10) > Assessment Methods

IA-5(10) Dynamic Credential Binding - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identifier management

system security plan

system design documentation

automated mechanisms providing dynamic binding of identifiers and authenticators

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Automated mechanisms implementing identifier management capability

automated mechanisms implementing dynamic binding of identities and authenticators
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(10) > Assessment Objective

IA-5(10) Dynamic Credential Binding - Assessment Objective
Determine if the following are satisfied:

identities and authenticators are dynamically bound using [Assignment: organization-defined binding rules].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(12) > Assessment Methods

IA-5(12) Biometric Authentication Performance - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing authenticator management

system security plan

system design documentation

mechanisms employing biometric-based authentication for the system

list of biometric quality requirements

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing biometric-based authenticator management capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(12) > Assessment Objective

IA-5(12) Biometric Authentication Performance - Assessment Objective
Determine if the following are satisfied:

mechanisms that satisfy [Assignment: organization-defined biometric quality requirements] are employed for biometric-based authentication.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(13) > Assessment Methods

IA-5(13) Expiration of Cached Authenticators - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing authenticator management

system security plan

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing authenticator management capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(13) > Assessment Objective

IA-5(13) Expiration of Cached Authenticators - Assessment Objective
Determine if the following are satisfied:

the use of cached authenticators is prohibited after [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(14) > Assessment Methods

IA-5(14) Managing Content of PKI Trust Stores - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing authenticator management

system security plan

organizational methodology for managing content of PKI trust stores across installed all platforms

system design documentation

system configuration settings and associated documentation

enterprise security architecture documentation

enterprise architecture documentation

other relevant documents or records

Interview: Organizational personnel with authenticator management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing PKI-based authenticator management capability

mechanisms supporting and/or implementing the PKI trust store capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(14) > Assessment Objective

IA-5(14) Managing Content of PKI Trust Stores - Assessment Objective
Determine if the following are satisfied:

an organization-wide methodology for managing the content of PKI trust stores is employed across all platforms, including networks, operating systems, browsers, and applications for PKI-based authentication.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(15) > Assessment Methods

IA-5(15) GSA-approved Products and Services - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identifier management

system security plan

system design documentation

mechanisms providing dynamic binding of identifiers and authenticators

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identification and authentication management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing account management capability

mechanisms supporting and/or implementing identification and authentication management capabilities for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(15) > Assessment Objective

IA-5(15) GSA-approved Products and Services - Assessment Objective
Determine if the following are satisfied:

only General Services Administration-approved products and services are used for identity, credential, and access management.