ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(10) > Assessment Methods

SA-8(10) Hierarchical Trust - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of hierarchical trust used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of hierarchical trust in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of hierarchical trust in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(10) > Assessment Objective

SA-8(10) Hierarchical Trust - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of hierarchical trust.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(11) > Assessment Methods

SA-8(11) Inverse Modification Threshold - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of inverse modification threshold used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of inverse modification threshold in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of inverse modification threshold in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(11) > Assessment Objective

SA-8(11) Inverse Modification Threshold - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of inverse modification threshold.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(12) > Assessment Methods

SA-8(12) Hierarchical Protection - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of hierarchical protection used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of hierarchical protection in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of hierarchical protection in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(12) > Assessment Objective

SA-8(12) Hierarchical Protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of hierarchical protection.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(13) > Assessment Methods

SA-8(13) Minimized Security Elements - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of minimized security elements used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of minimized security elements in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of minimized security elements in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(13) > Assessment Objective

SA-8(13) Minimized Security Elements - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of minimized security elements.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(14) > Assessment Methods

SA-8(14) Least Privilege - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of least privilege used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of least privilege in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of least privilege in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(14) > Assessment Objective

SA-8(14) Least Privilege - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of least privilege.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(15) > Assessment Methods

SA-8(15) Predicate Permission - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of predicate permission used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of predicate permission in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of predicate permission in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(15) > Assessment Objective

SA-8(15) Predicate Permission - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of predicate permission.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(16) > Assessment Methods

SA-8(16) Self-reliant Trustworthiness - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of self-reliant trustworthiness used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of self-reliant trustworthiness in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of self-reliant trustworthiness in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(16) > Assessment Objective

SA-8(16) Self-reliant Trustworthiness - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of self-reliant trustworthiness.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(17) > Assessment Methods

SA-8(17) Secure Distributed Composition - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of secure distributed composition used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of secure distributed composition in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of secure distributed composition in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(17) > Assessment Objective

SA-8(17) Secure Distributed Composition - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of secure distributed composition.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(18) > Assessment Methods

SA-8(18) Trusted Communications Channels - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of trusted communications channels used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of trusted communications channels in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of trusted communications channels in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(18) > Assessment Objective

SA-8(18) Trusted Communications Channels - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of trusted communications channels.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(19) > Assessment Methods

SA-8(19) Continuous Protection - Assessment Methods and Objects

Examine: System and services acquisition policy

access control policy

system and communications protection policy

procedures addressing boundary protection

procedures addressing the security design principle of continuous protection used in the specification, design, development, implementation, and modification of the system

system configuration settings and associated documentation

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

organizational personnel with access enforcement responsibilities

system/network administrators

system developers

organizational personnel with information security responsibilities

organizational personnel with boundary protection responsibilities

Test: Organizational processes for applying the security design principle of continuous protection in system specification, design, development, implementation, and modification

mechanisms implementing access enforcement functions

mechanisms supporting the application of the security design principle of continuous protection in system specification, design, development, implementation, and modification

mechanisms supporting and/or implementing secure failure
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(19) > Assessment Objective

SA-8(19) Continuous Protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of continuous protection.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(20) > Assessment Methods

SA-8(20) Secure Metadata Management - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of metadata management used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of metadata management in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of metadata management in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(20) > Assessment Objective

SA-8(20) Secure Metadata Management - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of secure metadata management.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(21) > Assessment Methods

SA-8(21) Self-analysis - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of self-analysis used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of self-analysis in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of self-analysis in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(21) > Assessment Objective

SA-8(21) Self-analysis - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of self-analysis.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(22) > Assessment Methods

SA-8(22) Accountability and Traceability - Assessment Methods and Objects

Examine: System and services acquisition policy

audit and accountability policy

access control policy

procedures addressing least privilege

procedures addressing auditable events

identification and authentication policy

procedures addressing user identification and authentication

procedures addressing the security design principle of accountability and traceability used in the specification, design, development, implementation, and modification of the system

system design documentation

system audit records

system auditable events

system configuration settings and associated documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with audit and accountability responsibilities

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of accountability and traceability in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of accountability and traceability in system specification, design, development, implementation, and modification

mechanisms implementing information system auditing

mechanisms implementing least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(22) > Assessment Objective

SA-8(22) Accountability and Traceability - Assessment Objective
Determine if the following are satisfied:

SA-08(22)[01] [Assignment: organization-defined systems or system components] implement the security design principle of accountability;
SA-08(22)[02] [Assignment: organization-defined systems or system components] implement the security design principle of traceability.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(23) > Assessment Methods

SA-8(23) Secure Defaults - Assessment Methods and Objects

Examine: System and services acquisition policy

configuration management policy

procedures addressing the security design principle of secure defaults used in the specification, design, development, implementation, and modification of the system

system design documentation

procedures addressing the baseline configuration of the system

configuration management plan

system architecture and configuration documentation

system configuration settings and associated documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

procedures addressing system documentation

system documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of secure defaults in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of secure defaults in system specification, design, development, implementation, and modification

organizational processes for managing baseline configurations

mechanisms supporting configuration control of the baseline configuration