ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-7 > Assessment Methods

PT-7 Specific Categories of Personally Identifiable Information - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

computer matching agreements and notices

contracts

privacy information sharing agreements

memoranda of understanding

governing requirements

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for supporting and/or implementing personally identifiable information processing
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-7 > Assessment Objective

PT-7 Specific Categories of Personally Identifiable Information - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined processing conditions] are applied for specific categories of personally identifiable information.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-7 > PT-7(1) > Assessment Methods

PT-7(1) Social Security Numbers - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

privacy notice

separate notice regarding the use of Social Security numbers

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for identifying, reviewing, and taking action to control the unnecessary use of Social Security numbers

implementation of an alternative to Social Security numbers as identifiers
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-7 > PT-7(1) > Assessment Objective

PT-7(1) Social Security Numbers - Assessment Objective
Determine if the following are satisfied:

PT-07(01)(a)[01] when a system processes Social Security numbers, the unnecessary collection, maintenance, and use of Social Security numbers are eliminated;
PT-07(01)(a)[02] when a system processes Social Security numbers, alternatives to the use of Social Security Numbers as a personal identifier are explored;
PT-07(01)(b) when a system processes Social Security numbers, individual rights, benefits, or privileges provided by law are not denied because of an individual's refusal to disclose their Social Security number;
PT-07(01)(c)[01] when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it;
PT-07(01)(c)[02] when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited;
PT-07(01)(c)[03] when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-7 > PT-7(2) > Assessment Methods

PT-7(2) First Amendment Information - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for supporting and/or implementing personally identifiable information processing
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-7 > PT-7(2) > Assessment Objective

PT-7(2) First Amendment Information - Assessment Objective
Determine if the following are satisfied:

the processing of information describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-8 > Assessment Methods

PT-8 Computer Matching Requirements - Assessment Methods and Objects

Examine: Personally identifiable information processing and transparency policy and procedures

privacy notice

Privacy Act system of records

Federal Register notices

Data Integrity Board determinations

contracts

information sharing agreements

memoranda of understanding

governing requirements

privacy plan

other relevant documents or records

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for supporting and/or implementing personally identifiable information processing

matching program
Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-8 > Assessment Objective

PT-8 Computer Matching Requirements - Assessment Objective
Determine if the following are satisfied:

PT-08a. approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;
PT-08b.[01] a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;
PT-08b.[02] a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;
PT-08c. a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;
PT-08d. the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;
PT-08e.[01] individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;
PT-08e.[02] individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-1 > Assessment Methods

RA-1 Policy and Procedures - Assessment Methods and Objects

Examine: Risk assessment policy and procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with risk assessment responsibilities

organizational personnel with security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-1 > Assessment Objective

RA-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

RA-01a.[01] a risk assessment policy is developed and documented;
RA-01a.[02] the risk assessment policy is disseminated to [Assignment: organization-defined personnel or roles];
RA-01a.[03] risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented;
RA-01a.[04] the risk assessment procedures are disseminated to [Assignment: organization-defined personnel or roles];
RA-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy addresses purpose;
RA-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy addresses scope;
RA-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy addresses roles;
RA-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy addresses responsibilities;
RA-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy addresses management commitment;
RA-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy addresses coordination among organizational entities;
RA-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy addresses compliance;
RA-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
RA-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures;
RA-01c.01[01] the current risk assessment policy is reviewed and updated [Assignment: organization-defined frequency];
RA-01c.01[02] the current risk assessment policy is reviewed and updated following [Assignment: organization-defined events];
RA-01c.02[01] the current risk assessment procedures are reviewed and updated [Assignment: organization-defined frequency];
RA-01c.02[02] the current risk assessment procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-2 > Assessment Methods

RA-2 Security Categorization - Assessment Methods and Objects

Examine: Risk assessment policy

security planning policy and procedures

procedures addressing security categorization of organizational information and systems

security categorization documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security categorization and risk assessment responsibilities

organizational personnel with security and privacy responsibilities

Test: Organizational processes for security categorization
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-2 > Assessment Objective

RA-2 Security Categorization - Assessment Objective
Determine if the following are satisfied:

RA-02a. the system and the information it processes, stores, and transmits are categorized;
RA-02b. the security categorization results, including supporting rationale, are documented in the security plan for the system;
RA-02c. the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-2 > RA-2(1) > Assessment Methods

RA-2(1) Impact-level Prioritization - Assessment Methods and Objects

Examine: Risk assessment policy

security and privacy planning policy and procedures

procedures addressing security categorization of organizational information and systems

security categorization documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security categorization and risk assessment responsibilities

organizational personnel with security and privacy responsibilities

Test: Organizational processes for security categorization
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-2 > RA-2(1) > Assessment Objective

RA-2(1) Impact-level Prioritization - Assessment Objective
Determine if the following are satisfied:

an impact-level prioritization of organizational systems is conducted to obtain additional granularity on system impact levels.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > Assessment Methods

RA-3 Risk Assessment - Assessment Methods and Objects

Examine: Risk assessment policy

risk assessment procedures

security and privacy planning policy and procedures

procedures addressing organizational assessments of risk

risk assessment

risk assessment results

risk assessment reviews

risk assessment updates

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with risk assessment responsibilities

organizational personnel with security and privacy responsibilities

Test: Organizational processes for risk assessment

mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > Assessment Objective

RA-3 Risk Assessment - Assessment Objective
Determine if the following are satisfied:

RA-03a.01 a risk assessment is conducted to identify threats to and vulnerabilities in the system;
RA-03a.02 a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information;
RA-03a.03 a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
RA-03b. risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments;
RA-03c. risk assessment results are documented in [Selection: security and privacy plans; risk assessment report; [Assignment: organization-defined document] ];
RA-03d. risk assessment results are reviewed [Assignment: organization-defined frequency];
RA-03e. risk assessment results are disseminated to [Assignment: organization-defined personnel or roles];
RA-03f. the risk assessment is updated [Assignment: organization-defined frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(1) > Assessment Methods

RA-3(1) Supply Chain Risk Assessment - Assessment Methods and Objects

Examine: Supply chain risk management policy

inventory of critical systems, system components, and system services

risk assessment policy

security planning policy and procedures

procedures addressing organizational assessments of supply chain risk

risk assessment

risk assessment results

risk assessment reviews

risk assessment updates

acquisition policy

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with risk assessment responsibilities

organizational personnel with security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for risk assessment

mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the supply chain risk assessment
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(1) > Assessment Objective

RA-3(1) Supply Chain Risk Assessment - Assessment Objective
Determine if the following are satisfied:

RA-03(01)(a) supply chain risks associated with [Assignment: organization-defined systems, system components, and system services] are assessed;
RA-03(01)(b) the supply chain risk assessment is updated [Assignment: organization-defined frequency] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(2) > Assessment Methods

RA-3(2) Use of All-source Intelligence - Assessment Methods and Objects

Examine: Risk assessment policy

security planning policy and procedures

procedures addressing organizational assessments of risk

risk assessment

risk assessment results

risk assessment reviews

risk assessment updates

risk intelligence reports

system security plan

other relevant documents or records

Interview: Organizational personnel with risk assessment responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for risk assessment

mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(2) > Assessment Objective

RA-3(2) Use of All-source Intelligence - Assessment Objective
Determine if the following are satisfied:

all-source intelligence is used to assist in the analysis of risk.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(3) > Assessment Methods

RA-3(3) Dynamic Threat Awareness - Assessment Methods and Objects

Examine: Risk assessment policy

security planning policy and procedures

procedures addressing organizational assessments of risk

risk assessment

risk assessment results

risk assessment reviews

risk assessment updates

risk reports

system security plan

other relevant documents or records

Interview: Organizational personnel with risk assessment responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for risk assessment

mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(3) > Assessment Objective

RA-3(3) Dynamic Threat Awareness - Assessment Objective
Determine if the following are satisfied:

the current cyber threat environment is determined on an ongoing basis using [Assignment: organization-defined means].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(4) > Assessment Methods

RA-3(4) Predictive Cyber Analytics - Assessment Methods and Objects

Examine: Risk assessment policy

security planning policy and procedures

procedures addressing organizational assessments of risk

risk assessment

risk assessment results

risk assessment reviews

risk assessment updates

risk reports

system security plan

other relevant documents or records

Interview: Organizational personnel with risk assessment responsibilities

organizational personnel with security responsibilities

Test: Organizational processes for risk assessment

mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-3 > RA-3(4) > Assessment Objective

RA-3(4) Predictive Cyber Analytics - Assessment Objective
Determine if the following are satisfied:

RA-03(04)[01] [Assignment: organization-defined advanced automation capabilities] are employed to predict and identify risks to [Assignment: organization-defined systems or system components];
RA-03(04)[02] [Assignment: organization-defined advanced analytics capabilities] are employed to predict and identify risks to [Assignment: organization-defined systems or system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > Assessment Methods

RA-5 Vulnerability Monitoring and Scanning - Assessment Methods and Objects

Examine: Risk assessment policy

procedures addressing vulnerability scanning

risk assessment

assessment report

vulnerability scanning tools and associated configuration documentation

vulnerability scanning results

patch and vulnerability management records

system security plan

other relevant documents or records

Interview: Organizational personnel with risk assessment, control assessment, and vulnerability scanning responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel with vulnerability remediation responsibilities

organizational personnel with security responsibilities

system/network administrators

Test: Organizational processes for vulnerability scanning, analysis, remediation, and information sharing

mechanisms supporting and/or implementing vulnerability scanning, analysis, remediation, and information sharing
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > Assessment Objective

RA-5 Vulnerability Monitoring and Scanning - Assessment Objective
Determine if the following are satisfied:

RA-05a.[01] systems and hosted applications are monitored for vulnerabilities [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
RA-05a.[02] systems and hosted applications are scanned for vulnerabilities [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
RA-05b. vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools;
RA-05b.01 vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws, and improper configurations;
RA-05b.02 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures;
RA-05b.03 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact;
RA-05c. vulnerability scan reports and results from vulnerability monitoring are analyzed;
RA-05d. legitimate vulnerabilities are remediated [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;
RA-05e. information obtained from the vulnerability monitoring process and control assessments is shared with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems;
RA-05f. vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
RA > RA-5 > RA-5(2) > Assessment Methods

RA-5(2) Update Vulnerabilities to Be Scanned - Assessment Methods and Objects

Examine: Procedures addressing vulnerability scanning

assessment report

vulnerability scanning tools and associated configuration documentation

vulnerability scanning results

patch and vulnerability management records

system security plan

other relevant documents or records

Interview: Organizational personnel with vulnerability scanning responsibilities

organizational personnel with vulnerability scan analysis responsibilities

organizational personnel with security responsibilities

system/network administrators

Test: Organizational processes for vulnerability scanning

mechanisms/tools supporting and/or implementing vulnerability scanning