ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(10) > Assessment Methods

SA-4(10) Use of Approved PIV Products - Assessment Methods and Objects

Examine: Supply chain risk management plan

system and services acquisition policy

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

solicitation documentation

acquisition documentation

acquisition contracts for the system, system component, or system service

service level agreements

FIPS 201 approved products list

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility for determining system security requirements

organizational personnel with the responsibility for ensuring that only FIPS 201- approved products are implemented

organizational personnel with information security responsibilities

Test: Organizational processes for selecting and employing FIPS 201-approved products
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(10) > Assessment Objective

SA-4(10) Use of Approved PIV Products - Assessment Objective
Determine if the following are satisfied:

only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(11) > Assessment Methods

SA-4(11) System of Records - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of Privacy Act requirements into systems of records operated by external organizations

solicitation documentation

acquisition documentation

acquisition contracts for the system, system component, or system service

service level agreements

system security plan

privacy plan

personally identifiable information processing policy

privacy program plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

Test: Contract management processes to verify Privacy Act requirements are defined for the operation of a system of records

vendor processes for demonstrating incorporation of Privacy Act requirements in its operation of a system of records
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(11) > Assessment Objective

SA-4(11) System of Records - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined Privacy Act requirements] are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(12) > Assessment Methods

SA-4(12) Data Ownership - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of information security and privacy requirements, descriptions, and criteria into the acquisition process

procedures addressing the disposition of personally identifiable information

solicitation documentation

acquisition documentation

acquisition contracts for the system or system service

personally identifiable information processing policy

service level agreements

information sharing agreements

memoranda of understanding

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility for data management and processing requirements

organizational personnel with information security and privacy responsibilities

Test: Contract management processes to verify that data is removed as required

vendor processes for removing data in required timeframe

mechanisms verifying the removal and return of data
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(12) > Assessment Objective

SA-4(12) Data Ownership - Assessment Objective
Determine if the following are satisfied:

SA-04(12)(a) organizational data ownership requirements are included in the acquisition contract;
SA-04(12)(b) all data to be removed from the contractor's system and returned to the organization is required within [Assignment: organization-defined time frame].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-5 > Assessment Methods

SA-5 System Documentation - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing system documentation

system documentation, including administrator and user guides

system design documentation

records documenting attempts to obtain unavailable or nonexistent system documentation

list of actions to be taken in response to documented attempts to obtain system, system component, or system service documentation

risk management strategy documentation

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with information security and privacy responsibilities

system administrators

organizational personnel responsible for operating, using, and/or maintaining the system

system developers

Test: Organizational processes for obtaining, protecting, and distributing system administrator and user documentation
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > Assessment Methods

SA-8 Security and Privacy Engineering Principles - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

assessment and authorization procedures

procedures addressing security and privacy engineering principles used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

Test: Organizational processes for applying security and privacy engineering principles in system specification, design, development, implementation, and modification

mechanisms supporting the application of security and privacy engineering principles in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > Assessment Objective

SA-8 Security and Privacy Engineering Principles - Assessment Objective
Determine if the following are satisfied:

SA-08[01] [Assignment: organization-defined systems security engineering principles] are applied in the specification of the system and system components;
SA-08[02] [Assignment: organization-defined systems security engineering principles] are applied in the design of the system and system components;
SA-08[03] [Assignment: organization-defined systems security engineering principles] are applied in the development of the system and system components;
SA-08[04] [Assignment: organization-defined systems security engineering principles] are applied in the implementation of the system and system components;
SA-08[05] [Assignment: organization-defined systems security engineering principles] are applied in the modification of the system and system components;
SA-08[06] [Assignment: organization-defined privacy engineering principles] are applied in the specification of the system and system components;
SA-08[07] [Assignment: organization-defined privacy engineering principles] are applied in the design of the system and system components;
SA-08[08] [Assignment: organization-defined privacy engineering principles] are applied in the development of the system and system components;
SA-08[09] [Assignment: organization-defined privacy engineering principles] are applied in the implementation of the system and system components;
SA-08[10] [Assignment: organization-defined privacy engineering principles] are applied in the modification of the system and system components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(1) > Assessment Methods

SA-8(1) Clear Abstractions - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of clear abstractions used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of clear abstractions to system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of clear abstractions to system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(1) > Assessment Objective

SA-8(1) Clear Abstractions - Assessment Objective
Determine if the following are satisfied:

the security design principle of clear abstractions is implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(2) > Assessment Methods

SA-8(2) Least Common Mechanism - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of least common mechanism used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of least common mechanism in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of least common mechanism in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(2) > Assessment Objective

SA-8(2) Least Common Mechanism - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of least common mechanism.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(3) > Assessment Methods

SA-8(3) Modularity and Layering - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principles of modularity and layering used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principles of modularity and layering in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principles of modularity and layering in system specification, design, development, implementation, and modification

mechanisms supporting and/or implementing an isolation boundary
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(3) > Assessment Objective

SA-8(3) Modularity and Layering - Assessment Objective
Determine if the following are satisfied:

SA-08(03)[01] [Assignment: organization-defined systems or system components] implement the security design principle of modularity;
SA-08(03)[02] [Assignment: organization-defined systems or system components] implement the security design principle of layering.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(4) > Assessment Methods

SA-8(4) Partially Ordered Dependencies - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of partially ordered dependencies used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of partially ordered dependencies in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of partially ordered dependencies in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(4) > Assessment Objective

SA-8(4) Partially Ordered Dependencies - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of partially ordered dependencies.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(5) > Assessment Methods

SA-8(5) Efficiently Mediated Access - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of efficiently mediated access used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of efficiently mediated access in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of efficiently mediated access in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(5) > Assessment Objective

SA-8(5) Efficiently Mediated Access - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of efficiently mediated access.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(6) > Assessment Methods

SA-8(6) Minimized Sharing - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of minimized sharing used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of minimized sharing in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of minimized sharing in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(6) > Assessment Objective

SA-8(6) Minimized Sharing - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of minimized sharing.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(7) > Assessment Methods

SA-8(7) Reduced Complexity - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of reduced complexity used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of reduced complexity in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of reduced complexity in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(7) > Assessment Objective

SA-8(7) Reduced Complexity - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of reduced complexity.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(8) > Assessment Methods

SA-8(8) Secure Evolvability - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of secure evolvability used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of secure evolvability in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of secure evolvability in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(8) > Assessment Objective

SA-8(8) Secure Evolvability - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of secure evolvability.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(9) > Assessment Methods

SA-8(9) Trusted Components - Assessment Methods and Objects

Examine: Supply chain risk management plan

system and services acquisition policy

procedures addressing the security design principle of trusted components used in the specification, design, development, implementation, and modification of the system

system design documentation

security, supply chain risk management, and privacy requirements and specifications for the system

system security and privacy architecture

procedures for determining component assurance

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for applying the security design principle of trusted components in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of trusted components in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(9) > Assessment Objective

SA-8(9) Trusted Components - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of trusted components.