ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > IMPLEMENT TASKS > TASK I-1

TASK I-1 Implement the controls in the security and privacy plans. Potential Inputs: Approved security and privacy plans; system design documents; organizational security and privacy policies and procedures; business impact or criticality analyses; enterprise architecture information; security architecture information; privacy architecture information; list of security and privacy requirements allocated to the system, system elements; and environment of operation; system element information; system component inventory; organization- and system-level risk assessment results. Expected Outputs: Implemented controls. Primary Responsibility: System Owner; Common Control Provider. Supporting Roles: Information Owner or Steward; Security Architect; Privacy Architect; Systems Security Engineer; Privacy Engineer; System Security Officer; System Privacy Officer; Enterprise Architect; System Administrator.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK I-2

TASK I-2 Document changes to planned control implementations based on the "as-implemented" state of controls. Potential Inputs: Security and privacy plans; information from control implementation efforts. Expected Outputs: Security and privacy plans updated with implementation detail sufficient for use by assessors; system configuration baseline. Primary Responsibility: System Owner; Common Control Provider. Supporting Roles: Information Owner or Steward; Security Architect; Privacy Architect; Systems Security Engineer; Privacy Engineer; System Security Officer; System Privacy Officer; Enterprise Architect; System Administrator. System Development Life Cycle Phase: New - Development/Acquisition; Implementation/Assessment. Existing - Operations/Maintenance. Discussion: Despite the control implementation details in the security and privacy plans and the system design documents, it is not always feasible to implement controls as planned. Therefore, as control implementations are carried out, the security and privacy plans are updated with as-implemented control implementation details. The updates include revised descriptions of implemented controls including changes to planned inputs, expected behavior, and expected outputs with sufficient detail to support control assessments. Documenting the "as implemented" control information is essential to providing the capability to determine when there are changes to the controls, whether those changes are authorized, and the impact of the changes on the security and privacy posture of the system and the organization. References: [SP 800-53]; [SP 800-128]; [SP 800-160 v1] (Implementation, Integration, Verification, and Transition, Configuration Management Processes).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK M-1

TASK M-1 System and Environment Changes Monitor the information system and its environment of operation for changes that impact the security and privacy posture of the system. • System Owner or Common Control Provider • Senior Agency Information Security Officer • Senior Agency Official for Privacy • Senior Accountable Official for Risk Management or Risk Executive (Function) • Authorizing Official or Authorizing Official Designated Representative • Information Owner or Steward • System Security Officer • System Privacy Officer
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK M-2

TASK M-2 Ongoing Assessments Assess the controls implemented within and inherited by the system in accordance with the continuous monitoring strategy. • Control Assessor • Authorizing Official or Authorizing Official Designated Representative • System Owner or Common Control Provider • Information Owner or Steward • System Security Officer • System Privacy Officer • Senior Agency Information Security Officer • Senior Agency Official for Privacy
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK M-3

TASK M-3 Ongoing Risk Response Respond to risk based on the results of ongoing monitoring activities, risk assessments, and outstanding items in plans of action and milestones. • Authorizing Official • System Owner • Common Control Provider • Senior Accountable Official for Risk Management or Risk Executive (Function) • Senior Agency Information Security Officer • Senior Agency Official for Privacy; Authorizing Official Designated Representative • Information Owner or Steward • System Security Officer • System Privacy Officer • Systems Security Engineer • Privacy Engineer • Security Architect • Privacy Architect
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK M-4

TASK M-4 Authorization Package Updates Update plans, assessment reports, and plans of action and milestones based on the results of the continuous monitoring process. • System Owner • Common Control Provider • Information Owner or Steward • System Security Officer • System Privacy Officer • Senior Agency Official for Privacy • Senior Agency Information Security Officer
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK M-5

TASK M-5 Security and Privacy Reporting Report the security and privacy posture of the system to the authorizing official and other organizational officials on an ongoing basis in accordance with the organizational continuous monitoring strategy. • System Owner • Common Control Provider • Senior Agency Information Security Officer • Senior Agency Official for Privacy • System Security Officer • System Privacy Officer
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK M-6

TASK M-6 Ongoing Authorization Review the security and privacy posture of the system on an ongoing basis to determine whether the risk remains acceptable. • Authorizing Official • Senior Accountable Official for Risk Management or Risk Executive (Function) • Chief Information Officer • Senior Agency Information Security Officer • Senior Agency Official for Privacy • Authorizing Official Designated Representative
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK M-7

TASK M-7 System Disposal Implement a system disposal strategy and execute required actions when a system is removed from operation. • System Owner • Authorizing Official or Authorizing Official Designated Representative • Information Owner or Steward • System Security Officer • System Privacy Officer • Senior Accountable Official for Risk Management or Risk Executive (Function) • Senior Agency Information Security Officer • Senior Agency Official for Privacy
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-1

TASK P-1 Identify and assign individuals to specific roles associated with security and privacy risk management. Potential Inputs: Organizational security and privacy policies and procedures; organizational charts. Expected Outputs: Documented Risk Management Framework role assignments. Primary Responsibility: Head of Agency; Chief Information Officer; Senior Agency Official for Privacy. Supporting Roles: Authorizing Official or Authorizing Official Designated Representative; Senior Accountable Official for Risk Management or Risk Executive (Function); Senior Agency Information Security Officer. Discussion: The roles and responsibilities of key participants in risk management processes are described in Appendix D. The roles and responsibilities may include personnel that are internal or external to the organization, as appropriate. Since organizations have different missions, functions, and organizational structures, there may be differences in naming conventions for risk management roles and how specific responsibilities are allocated among organizational personnel (e.g., multiple individuals filling a single role or one individual filling multiple roles). In either situation, the basic risk management functions remain the same. Organizations ensure that there are no conflicts of interest when assigning the same individual to multiple risk management roles. For example, authorizing officials cannot occupy the role of system owner or common control provider for systems or common controls they are authorizing. In addition, combining multiple roles for security and privacy requires care because the two disciplines may require different expertise, and in some circumstances, the priorities may be competing. Some roles may be allocated to a group or an office rather than to an individual, for example, control assessor, risk executive (function), or system administrator. References: [SP 800-160 v1] (Human Resource Management Process); [SP 800-181]; [NIST CSF] (Core [Identify Function]).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-10

TASK P-10 Identify assets that require protection. Potential Inputs: Missions, business functions, and mission/business processes the information system will support; business impact analyses; internal stakeholders; system stakeholder information; system information; information about other systems that interact with the system. Expected Outputs: Set of assets to be protected. Primary Responsibility: System Owner. Supporting Roles: Authorizing Official or Authorizing Official Designated Representative; Mission or Business Owner; Information Owner or Steward; Senior Agency Information Security Officer; Senior Agency Official for Privacy; System Administrator. System Development Life Cycle Phase: New - Initiation (concept/requirements definition). Existing - Operations/Maintenance. Discussion: Assets are tangible and intangible items that are of value to achievement of mission or business objectives. Tangible assets are physical in nature and include physical/environmental elements (e.g., non-digital information, structures, facilities), human elements, and technology/machine elements (e.g., hardware elements, mechanisms, and networks). In contrast, intangible assets are not physical in nature and include mission and business processes, functions, digital information and data, firmware, software, and services. Information assets can be tangible or intangible assets, and can include the information needed to carry out missions or business functions, to deliver services, and for system management/operation; controlled unclassified information and classified information; and all forms of documentation associated with the information system. Intangible assets can also include the image or reputation of an organization, and the privacy interests of the individuals whose information will be processed by the system. The organization defines the scope of stakeholder assets to be considered for protection. The assets that require protection are identified based on stakeholder concerns and the contexts in which the assets are used. This includes the missions or business functions of the organization; the other systems that interact with the system; and stakeholders whose assets are utilized by the mission or business functions or by the system. Assets can be documented in the system security and privacy plans. References: [SP 800-39] (Organization Level); [SP 800-64]; [SP 800-160 v1] (Stakeholder Needs and Requirements Definition Process); [IR 8179] (Criticality Analysis Process C); [NIST CSF] (Core [Identify Function]); [NARA CUI].
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-11

TASK P-11 Determine the authorization boundary of the system. Potential Inputs: System design documentation; network diagrams; system stakeholder information; asset information; network and/or enterprise architecture diagrams; organizational structure (charts, information). Expected Outputs: Documented authorization boundary. Primary Responsibility: Authorizing Official. Supporting Roles: Chief Information Officer; System Owner; Mission or Business Owner; Senior Agency Information Security Officer; Senior Agency Official for Privacy; Enterprise Architect. System Development Life Cycle Phase: New - Initiation (concept/requirements definition). Existing - Operations/Maintenance. Discussion: Authorization boundaries establish the scope of protection for information systems (i.e., what the organization agrees to protect under its management control or within the scope of its
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-12

TASK P-12 Identify the types of information to be processed, stored, and transmitted by the system. Potential Inputs: System design documentation; assets to be protected; mission/business process information; system design documentation. Expected Outputs: A list of information types for the system. Primary Responsibility: System Owner; Information Owner or Steward. Supporting Role: Mission or Business Owner; System Security Officer; System Privacy Officer.66 System Development Life Cycle Phase: New - Initiation (concept/requirements definition). Existing - Operations/Maintenance. Discussion: Identifying the types of information needed to support organizational missions, business functions, and mission/business processes is an important step in developing security and privacy plans for the system and a precondition for determining the security categorization. [NARA CUI] defines the information types that require protection as part of its Controlled Unclassified Information (CUI) program, in accordance with laws, regulations, or governmentwide policies. Organizations may define additional information types needed to support organizational missions, business functions, and mission/business 65 System elements are implemented via hardware, software, or firmware; physical structures or devices; or people, processes, and procedures. The term system component is used to indicate system elements that are implemented specifically via hardware, software, and firmware. 66 System Privacy Officer is only a primary role when the information system processes PII.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-15

TASK P-15 Define the security and privacy requirements for the system and the environment of operation. Potential Inputs: System design documentation; organization- and system-level risk assessment results; known set of stakeholder assets to be protected; missions, business functions, and mission/business processes the system will support; business impact analyses or criticality analyses; system stakeholder information; data map of the information life cycle for PII; Cybersecurity Framework Profiles; information about other systems that interact with the system; supply chain information; threat information; laws, executive orders, directives, regulations, or policies that apply to the system; risk management strategy. Expected Outputs: Documented security and privacy requirements. Primary Responsibility: Mission or Business Owner; System Owner; Information Owner or Steward; System Privacy Officer.69 69 The system privacy officer is a primary role only when the information system processes PII.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-16

TASK P-16 Determine the placement of the system within the enterprise architecture. Potential Inputs: Security and privacy requirements; organization- and system-level risk assessment results; enterprise architecture information; security architecture information; privacy architecture information; asset information. Expected Outputs: Updated enterprise architecture; updated security architecture; updated privacy architecture; plans to use cloud-based systems and shared systems, services, or applications. 70 For example, a fundamental security characteristic is that the system exhibits only specified behaviors, interactions, and outcomes. 71 The term requirements can have discrete meanings. For example, legal and policy requirements impose obligations to which organizations must adhere. Security and privacy requirements, however, are derived from the protection needs for the system and those protection needs can derive from legal or policy requirements, mission or business needs, risk assessments, or other sources. 72 Security and privacy requirements can also include assurance requirements. Assurance is having confidence about the ability of the system to remain trustworthy with respect to security and privacy across all forms of adversity resulting from malicious or non-malicious intent.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-17

TASK P-17 Allocate security and privacy requirements to the system and to the environment of operation. Potential Inputs: Organization- and system-level risk assessment results; documented security and privacy requirements; organization- and system-level risk assessment results; list of common control providers and common controls available for inheritance; system description; system element information; system component inventory; relevant laws, executive orders, directives, regulations, and policies. Expected Outputs: List of security and privacy requirements allocated to the system, system elements, and the environment of operation. Primary Responsibility: Security Architect; Privacy Architect; System Security Officer; System Privacy Officer. Supporting Roles: Chief Information Officer; Authorizing Official or Authorizing Official Designated Representative; Mission or Business Owner; Senior Agency Information Security Officer; Senior Agency Official for Privacy; System Owner. System Development Life Cycle Phase: New - Initiation (concept/requirements definition). Existing - Operations/Maintenance.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-18

TASK P-18 Register the system with organizational program or management offices. Potential Inputs: Organizational policy on system registration; system information. Expected Outputs: Registered system in accordance with organizational policy. Primary Responsibility: System Owner. Supporting Role: Mission or Business Owner; Chief Information Officer; System Security Officer; System Privacy Officer. System Development Life Cycle Phase: New - Initiation (concept/requirements definition). Existing - Operations/Maintenance. Discussion: System registration, in accordance with organizational policy, serves to inform the governing organization of plans to develop the system or the existence of the system; the key characteristics of the system; and the expected security and privacy implications for the organization due to the operation and use of the system. System registration provides organizations with a management and tracking tool to facilitate bringing the system into the enterprise architecture, implementation of protections that are commensurate with risk, and security and privacy posture reporting in accordance with applicable laws, executive orders, directives, regulations, policies, or standards. As part of the system registration process, organizations add the system to the organization-wide system inventory. System registration information is updated with security categorization and system characterization information upon completion of the Categorize step. References: None. 73 The environment of operation for an information system refers to the physical surroundings in which the system processes, stores, and transmits information. For example, security requirements are allocated to the facilities where the system is located and operates. Those security requirements can be satisfied by the physical security controls in [SP 800-53]
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-2

TASK P-2 Establish a risk management strategy for the organization that includes a determination of risk tolerance. Potential Inputs: Organizational mission statement; organizational policies; organizational risk assumptions, constraints, priorities and trade-offs. Expected Outputs: Risk management strategy and statement of risk tolerance inclusive of information security and privacy risk. Primary Responsibility: Head of Agency. Supporting Roles: Senior Accountable Official for Risk Management or Risk Executive (Function); Chief Information Officer; Senior Agency Information Security Officer; Senior Agency Official for Privacy. Discussion: Risk tolerance is the degree of risk or uncertainty that is acceptable to an organization. Risk tolerance affects all parts of the organization's risk management process, having a direct impact on the risk management decisions made by senior leaders or executives throughout the organization and providing important constraints on those decisions. The risk management strategy guides and informs risk-based decisions including how security and privacy risk is framed, assessed, responded to, and monitored. The risk management strategy may be composed of a single document, or separate security and privacy risk management documents.54 The risk management strategy makes explicit the threats, assumptions, constraints, priorities, trade-offs, and risk tolerance used for making investment and 54 A separate supply chain risk management strategy document is called a supply chain risk management plan.