ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
CP > CP-9 > CP-9(6) > Discussion

CP-9(6) Redundant Secondary System - Discussion
Family: Contingency Planning (CP) > CP-9 System Backup

The effect of system backup can be achieved by maintaining a redundant secondary system that mirrors the primary system, including the replication of information. If this type of redundancy is in place and there is sufficient geographic separation between the two systems, the secondary system can also serve as the alternate processing site.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-9 > CP-9(6)

CP-9(6) System Backup | Redundant Secondary System
Family: Contingency Planning (CP) > CP-9 System Backup

Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-9 > CP-9(7) > Discussion

CP-9(7) Dual Authorization for Deletion or Destruction - Discussion
Family: Contingency Planning (CP) > CP-9 System Backup

Dual authorization ensures that deletion or destruction of backup information cannot occur unless two qualified individuals carry out the task. Individuals deleting or destroying backup information possess the skills or expertise to determine if the proposed deletion or destruction of information reflects organizational policies and procedures. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-9 > CP-9(7)

CP-9(7) System Backup | Dual Authorization for Deletion or Destruction
Family: Contingency Planning (CP) > CP-9 System Backup

Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined backup information].
Security and Privacy Controls for Information Systems and Organizations
CP > CP-9 > CP-9(8) > Discussion

CP-9(8) Cryptographic Protection - Discussion
Family: Contingency Planning (CP) > CP-9 System Backup

The selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of backup information. The strength of mechanisms selected is commensurate with the security category or classification of the information. Cryptographic protection applies to system backup information in storage at both primary and alternate locations. Organizations that implement cryptographic mechanisms to protect information at rest also consider cryptographic key management solutions.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-9 > CP-9(8)

CP-9(8) System Backup | Cryptographic Protection
Family: Contingency Planning (CP) > CP-9 System Backup

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10

CP-10 System Recovery and Reconstitution
Family: Contingency Planning (CP)

Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10 > Discussion

CP-10 System Recovery and Reconstitution - Discussion
Family: Contingency Planning (CP)

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10 > CP-10(2) > Discussion

CP-10(2) Transaction Recovery - Discussion
Family: Contingency Planning (CP) > CP-10 System Recovery and Reconstitution

Transaction-based systems include database management systems and transaction processing systems. Mechanisms supporting transaction recovery include transaction rollback and transaction journaling.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10 > CP-10(2)

CP-10(2) System Recovery and Reconstitution | Transaction Recovery
Family: Contingency Planning (CP) > CP-10 System Recovery and Reconstitution

Implement transaction recovery for systems that are transaction-based.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10 > CP-10(4) > Discussion

CP-10(4) Restore Within Time Period - Discussion
Family: Contingency Planning (CP) > CP-10 System Recovery and Reconstitution

Restoration of system components includes reimaging, which restores the components to known, operational states.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10 > CP-10(4)

CP-10(4) System Recovery and Reconstitution | Restore Within Time Period
Family: Contingency Planning (CP) > CP-10 System Recovery and Reconstitution

Provide the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10 > CP-10(6) > Discussion

CP-10(6) Component Protection - Discussion
Family: Contingency Planning (CP) > CP-10 System Recovery and Reconstitution

Protection of system recovery and reconstitution components (i.e., hardware, firmware, and software) includes physical and technical controls. Backup and restoration components used for recovery and reconstitution include router tables, compilers, and other system software.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-10 > CP-10(6)

CP-10(6) System Recovery and Reconstitution | Component Protection
Family: Contingency Planning (CP) > CP-10 System Recovery and Reconstitution

Protect system components used for recovery and reconstitution.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-11

CP-11 Alternate Communications Protocols
Family: Contingency Planning (CP)

Provide the capability to employ [Assignment: organization-defined alternative communications protocols] in support of maintaining continuity of operations.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-11 > Discussion

CP-11 Alternate Communications Protocols - Discussion
Family: Contingency Planning (CP)

Contingency plans and the contingency training or testing associated with those plans incorporate an alternate communications protocol capability as part of establishing resilience in organizational systems. Switching communications protocols may affect software applications and operational aspects of systems. Organizations assess the potential side effects of introducing alternate communications protocols prior to implementation.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-12

CP-12 Safe Mode
Family: Contingency Planning (CP)

When [Assignment: organization-defined conditions] are detected, enter a safe mode of operation with [Assignment: organization-defined restrictions].
Security and Privacy Controls for Information Systems and Organizations
CP > CP-12 > Discussion

CP-12 Safe Mode - Discussion
Family: Contingency Planning (CP)

For systems that support critical mission and business functions-including military operations, civilian space operations, nuclear power plant operations, and air traffic control operations (especially real-time operational environments)-organizations can identify certain conditions under which those systems revert to a predefined safe mode of operation. The safe mode of operation, which can be activated either automatically or manually, restricts the operations that systems can execute when those conditions are encountered. Restriction includes allowing only selected functions to execute that can be carried out under limited power or with reduced communications bandwidth.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-13

CP-13 Alternative Security Mechanisms
Family: Contingency Planning (CP)

Employ [Assignment: organization-defined alternative or supplemental security mechanisms] for satisfying [Assignment: organization-defined security functions] when the primary means of implementing the security function is unavailable or compromised.
Security and Privacy Controls for Information Systems and Organizations
CP > CP-13 > Discussion

CP-13 Alternative Security Mechanisms - Discussion
Family: Contingency Planning (CP)

Use of alternative security mechanisms supports system resiliency, contingency planning, and continuity of operations. To ensure mission and business continuity, organizations can implement alternative or supplemental security mechanisms. The mechanisms may be less effective than the primary mechanisms. However, having the capability to readily employ alternative or supplemental mechanisms enhances mission and business continuity that might otherwise be adversely impacted if operations had to be curtailed until the primary means of implementing the functions was restored. Given the cost and level of effort required to provide such alternative capabilities, the alternative or supplemental mechanisms are only applied to critical security capabilities provided by systems, system components, or system services. For example, an organization may issue one-time pads to senior executives, officials, and system administrators if multi-factor tokens-the standard means for achieving secure authentication- are compromised.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-1

IA-1 Policy and Procedures
Family: Identification and Authentication (IA)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; and
c. Review and update the current identification and authentication:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-1 > Discussion

IA-1 Policy and Procedures - Discussion
Family: Identification and Authentication (IA)

Identification and authentication policy and procedures address the controls in the IA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of identification and authentication policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to identification and authentication policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2

IA-2 Identification and Authentication (Organizational Users)
Family: Identification and Authentication (IA)

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > Discussion

IA-2 Identification and Authentication (Organizational Users) - Discussion
Family: Identification and Authentication (IA)

Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity.

Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks.

The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in [IA-8](#ia-8).
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(1) > Discussion

IA-2(1) Multi-factor Authentication to Privileged Accounts - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification (PIV) card or the Department of Defense (DoD) Common Access Card (CAC). In addition to authenticating users at the system level (i.e., at logon), organizations may employ authentication mechanisms at the application level, at their discretion, to provide increased security. Regardless of the type of access (i.e., local, network, remote), privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can add additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(1)

IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Implement multi-factor authentication for access to privileged accounts.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(2) > Discussion

IA-2(2) Multi-factor Authentication to Non-privileged Accounts - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification card or the DoD Common Access Card. In addition to authenticating users at the system level, organizations may also employ authentication mechanisms at the application level, at their discretion, to provide increased information security. Regardless of the type of access (i.e., local, network, remote), non-privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can provide additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(2)

IA-2(2) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged Accounts
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Implement multi-factor authentication for access to non-privileged accounts.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(5) > Discussion

IA-2(5) Individual Authentication with Group Authentication - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Individual authentication prior to shared group authentication mitigates the risk of using group accounts or authenticators.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(5)

IA-2(5) Identification and Authentication (Organizational Users) | Individual Authentication with Group Authentication
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(6) > Discussion

IA-2(6) Access to Accounts -separate Device - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during multi-factor authentication is to reduce the likelihood of compromising authenticators or credentials stored on the system. Adversaries may be able to compromise such authenticators or credentials and subsequently impersonate authorized users. Implementing one of the factors on a separate device (e.g., a hardware token), provides a greater strength of mechanism and an increased level of assurance in the authentication process.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(6)

IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts -separate Device
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Implement multi-factor authentication for [Selection; one or more: local; network; remote] access to [Selection; one or more: privileged accounts; non-privileged accounts] such that:
(a) One of the factors is provided by a device separate from the system gaining access; and
(b) The device meets [Assignment: organization-defined strength of mechanism requirements].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(8) > Discussion

IA-2(8) Access to Accounts - Replay Resistant - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Authentication processes resist replay attacks if it is impractical to achieve successful authentications by replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or cryptographic authenticators.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(8)

IA-2(8) Identification and Authentication (Organizational Users) | Access to Accounts - Replay Resistant
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Implement replay-resistant authentication mechanisms for access to [Selection; one or more: privileged accounts; non-privileged accounts].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-2 > IA-2(10) > Discussion

IA-2(10) Single Sign-on - Discussion
Family: Identification and Authentication (IA) > IA-2 Identification and Authentication (Organizational Users)

Single sign-on enables users to log in once and gain access to multiple system resources. Organizations consider the operational efficiencies provided by single sign-on capabilities with the risk introduced by allowing access to multiple systems via a single authentication event. Single sign-on can present opportunities to improve system security, for example by providing the ability to add multi-factor authentication for applications and systems (existing and new) that may not be able to natively support multi-factor authentication.