ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > Assessment Objective

SA-15 Development Process, Standards, and Tools - Assessment Objective
Determine if the following are satisfied:

SA-15a.01[01] the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements;
SA-15a.01[02] the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements;
SA-15a.02[01] the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process;
SA-15a.02[02] the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process;
SA-15a.03[01] the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool used in the development process;
SA-15a.03[02] the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool configurations used in the development process;
SA-15a.04 the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development;
SA-15b.[01] the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignment: organization-defined frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignment: organization-defined security requirements];
SA-15b.[02] the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignment: organization-defined frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignment: organization-defined privacy requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(1) > Assessment Methods

SA-15(1) Quality Metrics - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing development process, standards, and tools

procedures addressing the integration of security requirements into the acquisition process

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

list of quality metrics

documentation evidence of meeting quality metrics

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(1) > Assessment Objective

SA-15(1) Quality Metrics - Assessment Objective
Determine if the following are satisfied:

SA-15(01)(a) the developer of the system, system component, or system service is required to define quality metrics at the beginning of the development process;
SA-15(01)(b) the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics [Selection; one or more: [Assignment: organization-defined frequency] ; [Assignment: organization-defined program review] ; upon delivery].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(2) > Assessment Methods

SA-15(2) Security and Privacy Tracking Tools - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing development process, standards, and tools

procedures addressing the integration of security and privacy requirements into the acquisition process

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

documentation of the selection of security and privacy tracking tools

evidence of employing security and privacy tracking tools

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(2) > Assessment Objective

SA-15(2) Security and Privacy Tracking Tools - Assessment Objective
Determine if the following are satisfied:

SA-15(02)[01] the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process;
SA-15(02)[02] the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(3) > Assessment Methods

SA-15(3) Criticality Analysis - Assessment Methods and Objects

Examine: Supply chain risk management plan

system and services acquisition policy

procedures addressing development process, standards, and tools

procedures addressing criticality analysis requirements for the system, system component, or system service

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

criticality analysis documentation

business impact analysis documentation

software development life cycle documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel responsible for performing criticality analysis

system developer

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for performing criticality analysis

mechanisms supporting and/or implementing criticality analysis
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(3) > Assessment Objective

SA-15(3) Criticality Analysis - Assessment Objective
Determine if the following are satisfied:

SA-15(03)(a) the developer of the system, system component, or system service is required to perform a criticality analysis at [Assignment: organization-defined decision points] in the system development life cycle;
SA-15(03)(b)[01] the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignment: organization-defined breadth];
SA-15(03)(b)[02] the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignment: organization-defined depth] .
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(5) > Assessment Methods

SA-15(5) Attack Surface Reduction - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing development process, standards, and tools

procedures addressing attack surface reduction

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system or system service

system design documentation

network diagram

system configuration settings and associated documentation establishing/enforcing organization-defined thresholds for reducing attack surfaces

list of restricted ports, protocols, functions, and services

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel responsible for attack surface reduction thresholds

system developer

Test: Organizational processes for defining attack surface reduction thresholds
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(5) > Assessment Objective

SA-15(5) Attack Surface Reduction - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to reduce attack surfaces to [Assignment: organization-defined thresholds].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(6) > Assessment Methods

SA-15(6) Continuous Improvement - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing development process, standards, and tools

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

quality goals and metrics for improving the system development process

security assessments

quality control reviews of system development process

plans of action and milestones for improving the system development process

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(6) > Assessment Objective

SA-15(6) Continuous Improvement - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to implement an explicit process to continuously improve the development process.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(7) > Assessment Methods

SA-15(7) Automated Vulnerability Analysis - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing development process, standards, and tools

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

vulnerability analysis tools and associated documentation

risk assessment reports

vulnerability analysis results

vulnerability mitigation reports

risk mitigation strategy documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel performing automated vulnerability analysis on the system

Test: Organizational processes for vulnerability analysis of systems, system components, or system services under development

mechanisms supporting and/or implementing vulnerability analysis of systems, system components, or system services under development
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(7) > Assessment Objective

SA-15(7) Automated Vulnerability Analysis - Assessment Objective
Determine if the following are satisfied:

SA-15(07)(a) the developer of the system, system component, or system service is required to perform automated vulnerability analysis [Assignment: organization-defined frequency] using [Assignment: organization-defined tools];
SA-15(07)(b) the developer of the system, system component, or system service is required to determine the exploitation potential for discovered vulnerabilities [Assignment: organization-defined frequency];
SA-15(07)(c) the developer of the system, system component, or system service is required to determine potential risk mitigations [Assignment: organization-defined frequency] for delivered vulnerabilities;
SA-15(07)(d) the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis [Assignment: organization-defined frequency] to [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(8) > Assessment Methods

SA-15(8) Reuse of Threat and Vulnerability Information - Assessment Methods and Objects

Examine: System and services acquisition policy

supply chain risk management plan

procedures addressing development process, standards, and tools

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

threat modeling and vulnerability analyses from similar systems, system components, or system services

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with supply chain risk management responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(8) > Assessment Objective

SA-15(8) Reuse of Threat and Vulnerability Information - Assessment Objective
Determine if the following are satisfied:

SA-15(08)[01] the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process;
SA-15(08)[02] the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(10) > Assessment Methods

SA-15(10) Incident Response Plan - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing incident response, standards, and tools

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system components or services

acquisition documentation

solicitation documentation

service level agreements

developer incident response plan

system security plan

privacy plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with supply chain risk management responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(10) > Assessment Objective

SA-15(10) Incident Response Plan - Assessment Objective
Determine if the following are satisfied:

SA-15(10)[01] the developer of the system, system component, or system service is required to provide an incident response plan;
SA-15(10)[02] the developer of the system, system component, or system service is required to implement an incident response plan;
SA-15(10)[03] the developer of the system, system component, or system service is required to test an incident response plan.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(11) > Assessment Methods

SA-15(11) Archive System or Component - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing development process, standards, and tools

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system or system component

evidence of archived system or component

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system developer

organizational personnel with privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(11) > Assessment Objective

SA-15(11) Archive System or Component - Assessment Objective
Determine if the following are satisfied:

the developer of the system or system component is required to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(12) > Assessment Methods

SA-15(12) Minimize Personally Identifiable Information - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the development process

procedures addressing the minimization of personally identifiable information in testing, training, and research

personally identifiable information processing policy

procedures addressing the authority to test with personally identifiable information

standards and tools

solicitation documentation

service level agreements

acquisition contracts for the system or services

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer

Test: Organizational processes for the minimization of personally identifiable information in development and test environments

mechanisms to facilitate the minimization of personally identifiable information in development and test environments
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(12) > Assessment Objective

SA-15(12) Minimize Personally Identifiable Information - Assessment Objective
Determine if the following are satisfied:

the developer of the system or system component is required to minimize the use of personally identifiable information in development and test environments.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(13) > Assessment Methods

SA-15(13) Logging Syntax - Assessment Methods and Objects

Examine: System and services acquisition policy;

solicitation documentation;

acquisition documentation;

service level agreements;

acquisition contracts for the system, system component, or system service;

requirements for logging format, event types, and level of detail;

documentation evidence of requirements for logging format, event types, and level of detail;

system security plan; other relevant documents or records.

Interview: Organizational personnel with system and service acquisition responsibilities;

organizational personnel with information security responsibilities;

system developer

Test: Developer logs for the system, system component, or system service.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-15 > SA-15(13) > Assessment Objective

SA-15(13) Logging Syntax - Assessment Objective
Determine if the following are satisfied:

Determine if:

the developer of the system, system component, or system service uses [Assignment: organization-defined secure logging format(s)] to log [Assignment: organization-defined events types to log] at [Assignment: organization-defined level of detail to log].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-16 > Assessment Methods

SA-16 Developer-provided Training - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing developer-provided training

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

organizational security and privacy training policy

developer-provided training materials

training records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer

external or internal (in-house) developers with training responsibilities for the system, system component, or information system service
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-16 > Assessment Objective

SA-16 Developer-provided Training - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to provide [Assignment: organization-defined training] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-17 > Assessment Methods

SA-17 Developer Security and Privacy Architecture and Design - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

enterprise architecture policy

enterprise architecture documentation

procedures addressing developer security and privacy architecture and design specifications for the system

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system design documentation

information system configuration settings and associated documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer