ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > SI-12(3) > Assessment Methods

SI-12(3) Information Disposal - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

personally identifiable information processing procedures

records retention and disposition policy

records retention and disposition procedures

laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal

media protection policy

media protection procedures

system audit records

audit findings

information disposal records

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities

organizational personnel with information security and privacy responsibilities

network administrators

Test: Organizational processes for information disposition

automated mechanisms supporting and/or implementing information disposition
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-12 > SI-12(3) > Assessment Objective

SI-12(3) Information Disposal - Assessment Objective
Determine if the following are satisfied:

SI-12(03)[01] [Assignment: organization-defined techniques] are used to dispose of information following the retention period;
SI-12(03)[02] [Assignment: organization-defined techniques] are used to destroy information following the retention period;
SI-12(03)[03] [Assignment: organization-defined techniques] are used to erase information following the retention period.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > Assessment Methods

SI-13 Predictable Failure Prevention - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing predictable failure prevention

system design documentation

system configuration settings and associated documentation

list of MTTF substitution criteria

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for MTTF determinations and activities

organizational personnel with information security responsibilities

system/network administrators

organizational personnel with contingency planning responsibilities

Test: Organizational processes for managing MTTF
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > Assessment Objective

SI-13 Predictable Failure Prevention - Assessment Objective
Determine if the following are satisfied:

SI-13a. mean time to failure (MTTF) is determined for [Assignment: organization-defined system components] in specific environments of operation;
SI-13b. substitute system components and a means to exchange active and standby components are provided in accordance with [Assignment: organization-defined mean time to failure (MTTF) substitution criteria].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(1) > Assessment Methods

SI-13(1) Transferring Component Responsibilities - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing predictable failure prevention

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for MTTF activities

organizational personnel with information security responsibilities

system/network administrators

organizational personnel with contingency planning responsibilities

Test: Organizational processes for managing MTTF

automated mechanisms supporting and/or implementing the transfer of component responsibilities to substitute components
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(1) > Assessment Objective

SI-13(1) Transferring Component Responsibilities - Assessment Objective
Determine if the following are satisfied:

system components are taken out of service by transferring component responsibilities to substitute components no later than [Assignment: organization-defined fraction or percentage] of mean time to failure.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(3) > Assessment Methods

SI-13(3) Manual Transfer Between Components - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing predictable failure prevention

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for MTTF activities

organizational personnel with information security responsibilities

system/network administrators

organizational personnel with contingency planning responsibilities

Test: Organizational processes for managing MTTF and conducting the manual transfer between active and standby components
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(3) > Assessment Objective

SI-13(3) Manual Transfer Between Components - Assessment Objective
Determine if the following are satisfied:

transfers are initiated manually between active and standby system components when the use of the active component reaches [Assignment: organization-defined percentage] of the mean time to failure.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(4) > Assessment Methods

SI-13(4) Standby Component Installation and Notification - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing predictable failure prevention

system design documentation

system configuration settings and associated documentation

list of actions to be taken once system component failure is detected

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for MTTF activities

organizational personnel with information security responsibilities

system/network administrators

organizational personnel with contingency planning responsibilities

Test: Organizational processes for managing MTTF

automated mechanisms supporting and/or implementing the transparent installation of standby components

automated mechanisms supporting and/or implementing alarms or system shutdown if component failures are detected
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(4) > Assessment Objective

SI-13(4) Standby Component Installation and Notification - Assessment Objective
Determine if the following are satisfied:

SI-13(04)(a) the standby components are successfully and transparently installed within [Assignment: organization-defined time period] if system component failures are detected;
SI-13(04)(b) [Selection; one or more: activate [Assignment: organization-defined alarm] ; automatically shut down the system; [Assignment: organization-defined action] ] are performed if system component failures are detected.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(5) > Assessment Methods

SI-13(5) Failover Capability - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing predictable failure prevention

system design documentation

system configuration settings and associated documentation

documentation describing the failover capability provided for the system

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for the failover capability

organizational personnel with information security responsibilities

system/network administrators

organizational personnel with contingency planning responsibilities

Test: Organizational processes for managing the failover capability

automated mechanisms supporting and/or implementing the failover capability
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-13 > SI-13(5) > Assessment Objective

SI-13(5) Failover Capability - Assessment Objective
Determine if the following are satisfied:

[Selection: real-time; near real-time] [Assignment: organization-defined failover capability] is provided for the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > Assessment Methods

SI-14 Non-persistence - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing non-persistence for system components

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for non-persistence

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Automated mechanisms supporting and/or implementing the initiation and termination of non-persistent components
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > Assessment Objective

SI-14 Non-persistence - Assessment Objective
Determine if the following are satisfied:

SI-14[01] non-persistent [Assignment: organization-defined system components and services] that are initiated in a known state are implemented;
SI-14[02] non-persistent [Assignment: organization-defined system components and services] are terminated [Selection; one or more: upon end of session of use; [Assignment: organization-defined frequency] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > SI-14(1) > Assessment Methods

SI-14(1) Refresh from Trusted Sources - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing non-persistence for system components

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for obtaining component and service refreshes from trusted sources

organizational personnel with information security responsibilities

Test: Organizational processes for defining and obtaining component and service refreshes from trusted sources

automated mechanisms supporting and/or implementing component and service refreshes
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > SI-14(1) > Assessment Objective

SI-14(1) Refresh from Trusted Sources - Assessment Objective
Determine if the following are satisfied:

the software and data employed during system component and service refreshes are obtained from [Assignment: organization-defined trusted sources].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > SI-14(2) > Assessment Methods

SI-14(2) Non-persistent Information - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing non-persistence for system components

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for ensuring that information is and remains non-persistent

organizational personnel with information security responsibilities

Test: Organizational processes for ensuring that information is and remains non-persistent

automated mechanisms supporting and/or implementing component and service refreshes
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > SI-14(2) > Assessment Objective

SI-14(2) Non-persistent Information - Assessment Objective
Determine if the following are satisfied:

SI-14(02)(a) [Selection: refresh [Assignment: organization-defined information] [Assignment: organization-defined frequency] ; generate [Assignment: organization-defined information] on demand] is performed;
SI-14(02)(b) information is deleted when no longer needed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > SI-14(3) > Assessment Methods

SI-14(3) Non-persistent Connectivity - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing non-persistence for system components

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for limiting persistent connections

organizational personnel with information security responsibilities

Test: Organizational processes for limiting persistent connections

automated mechanisms supporting and/or implementing non-persistent connectivity
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-14 > SI-14(3) > Assessment Objective

SI-14(3) Non-persistent Connectivity - Assessment Objective
Determine if the following are satisfied:

SI-14(03)[01] connections to the system are established on demand;
SI-14(03)[02] connections to the system are terminated after [Selection: completion of a request; a period of non-use].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-15 > Assessment Methods

SI-15 Information Output Filtering - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing information output filtering

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for validating information output

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational processes for validating information output

automated mechanisms supporting and/or implementing information output validation
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-15 > Assessment Objective

SI-15 Information Output Filtering - Assessment Objective
Determine if the following are satisfied:

information output from [Assignment: organization-defined software programs and/or applications] is validated to ensure that the information is consistent with the expected content.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-16 > Assessment Methods

SI-16 Memory Protection - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing memory protection for the system

system design documentation

system configuration settings and associated documentation

list of security safeguards protecting system memory from unauthorized code execution

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for memory protection

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Automated mechanisms supporting and/or implementing safeguards to protect the system memory from unauthorized code execution
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-16 > Assessment Objective

SI-16 Memory Protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined controls] are implemented to protect the system memory from unauthorized code execution.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-17 > Assessment Methods

SI-17 Fail-safe Procedures - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

documentation addressing fail-safe procedures for the system

system design documentation

system configuration settings and associated documentation

list of security safeguards protecting the system memory from unauthorized code execution

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for fail-safe procedures

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Organizational fail-safe procedures

automated mechanisms supporting and/or implementing fail-safe procedures
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-17 > Assessment Objective

SI-17 Fail-safe Procedures - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined fail-safe procedures] are implemented when [Assignment: organization-defined list of failure conditions] occur.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > Assessment Methods

SI-18 Personally Identifiable Information Quality Operations - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

documentation addressing personally identifiable information quality operations

quality reports

maintenance logs

system audit records

audit findings

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for performing personally identifiable information quality inspections

organizational personnel with information security responsibilities

organizational personnel with privacy responsibilities

Test: Organizational processes for personally identifiable information quality inspection

automated mechanisms supporting and/or implementing personally identifiable information quality operations
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > Assessment Objective

SI-18 Personally Identifiable Information Quality Operations - Assessment Objective
Determine if the following are satisfied:

SI-18a.[01] the accuracy of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
SI-18a.[02] the relevance of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
SI-18a.[03] the timeliness of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
SI-18a.[04] the completeness of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
SI-18b. inaccurate or outdated personally identifiable information is corrected or deleted.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(1) > Assessment Methods

SI-18(1) Automation Support - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

documentation addressing personally identifiable information quality operations

quality reports

maintenance logs

system audit records

audit findings

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for performing personally identifiable information quality inspections

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for personally identifiable information quality inspection

automated mechanisms supporting and/or implementing personally identifiable information quality operations
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(1) > Assessment Objective

SI-18(1) Automation Support - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined automated mechanisms] are used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(2) > Assessment Methods

SI-18(2) Data Tags - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

procedures addressing data tagging

personally identifiable information inventory

system audit records

audit findings

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for tagging data

organizational personnel with information security and privacy responsibilities

Test: Data tagging mechanisms

automated mechanisms supporting and/or implementing data tagging
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(2) > Assessment Objective

SI-18(2) Data Tags - Assessment Objective
Determine if the following are satisfied:

data tags are employed to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(3) > Assessment Methods

SI-18(3) Collection - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

system configuration documentation

system audit records

user interface where personally identifiable information is collected

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel responsible for data collection

organizational personnel with information security and privacy responsibilities

Test: Data collection mechanisms

automated mechanisms supporting and/or validating collection directly from the individual
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-18 > SI-18(3) > Assessment Objective

SI-18(3) Collection - Assessment Objective
Determine if the following are satisfied:

personally identifiable information is collected directly from the individual.