ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(4) > Assessment Objective

CP-8(4) Provider Contingency Plan - Assessment Objective
Determine if the following are satisfied:

CP-08(04)(a)[01] primary telecommunications service providers are required to have contingency plans;
CP-08(04)(a)[02] alternate telecommunications service providers are required to have contingency plans;
CP-08(04)(b) provider contingency plans are reviewed to ensure that the plans meet organizational contingency requirements;
CP-08(04)(c)[01] evidence of contingency testing by providers is obtained [Assignment: organization-defined frequency].
CP-08(04)(c)[02] evidence of contingency training by providers is obtained [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(5) > Assessment Methods

CP-8(5) Alternate Telecommunication Service Testing - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate telecommunications services

contingency plan

evidence of testing alternate telecommunications services

alternate telecommunications service agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning, plan implementation, and testing responsibilities

alternate telecommunications service providers

organizational personnel with information security responsibilities

Test: Mechanisms supporting testing alternate telecommunications services
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-8 > CP-8(5) > Assessment Objective

CP-8(5) Alternate Telecommunication Service Testing - Assessment Objective
Determine if the following are satisfied:

alternate telecommunications services are tested [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > Assessment Methods

CP-9 System Backup - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

backup storage location(s)

system backup logs or records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system backup responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for conducting system backups

mechanisms supporting and/or implementing system backups
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > Assessment Objective

CP-9 System Backup - Assessment Objective
Determine if the following are satisfied:

CP-09a. backups of user-level information contained in [Assignment: organization-defined system components] are conducted [Assignment: organization-defined frequency];
CP-09b. backups of system-level information contained in the system are conducted [Assignment: organization-defined frequency];
CP-09c. backups of system documentation, including security- and privacy-related documentation are conducted [Assignment: organization-defined frequency];
CP-09d.[01] the confidentiality of backup information is protected;
CP-09d.[02] the integrity of backup information is protected;
CP-09d.[03] the availability of backup information is protected.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(1) > Assessment Methods

CP-9(1) Testing for Reliability and Integrity - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

system backup test results

contingency plan test documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with system backup responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for conducting system backups

mechanisms supporting and/or implementing system backups
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(1) > Assessment Objective

CP-9(1) Testing for Reliability and Integrity - Assessment Objective
Determine if the following are satisfied:

CP-09(01)[01] backup information is tested [Assignment: organization-defined frequency] to verify media reliability;
CP-09(01)[02] backup information is tested [Assignment: organization-defined frequency] to verify information integrity.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(2) > Assessment Methods

CP-9(2) Test Restoration Using Sampling - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

system backup test results

contingency plan test documentation

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with system backup responsibilities

organizational personnel with contingency planning/contingency plan testing responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for conducting system backups

mechanisms supporting and/or implementing system backups
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(2) > Assessment Objective

CP-9(2) Test Restoration Using Sampling - Assessment Objective
Determine if the following are satisfied:

a sample of backup information in the restoration of selected system functions is used as part of contingency plan testing.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(3) > Assessment Methods

CP-9(3) Separate Storage for Critical Information - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

backup storage location(s)

system backup configurations and associated documentation

system backup logs or records

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with system backup responsibilities

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(3) > Assessment Objective

CP-9(3) Separate Storage for Critical Information - Assessment Objective
Determine if the following are satisfied:

backup copies of [Assignment: organization-defined critical system software and other security-related information] are stored in a separate facility or in a fire rated container that is not collocated with the operational system.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(5) > Assessment Methods

CP-9(5) Transfer to Alternate Storage Site - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

system backup logs or records

evidence of system backup information transferred to alternate storage site

alternate storage site agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with system backup responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for transferring system backups to the alternate storage site

mechanisms supporting and/or implementing system backups

mechanisms supporting and/or implementing information transfer to the alternate storage site
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(5) > Assessment Objective

CP-9(5) Transfer to Alternate Storage Site - Assessment Objective
Determine if the following are satisfied:

CP-09(05)[01] system backup information is transferred to the alternate storage site for [Assignment: organization-defined time period];
CP-09(05)[02] system backup information is transferred to the alternate storage site [Assignment: organization-defined transfer rate].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(6) > Assessment Methods

CP-9(6) Redundant Secondary System - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

system backup test results

contingency plan test results

contingency plan test documentation

redundant secondary system for system backups

location(s) of redundant secondary backup system(s)

system security plan

other relevant documents or records

Interview: Organizational personnel with system backup responsibilities

organizational personnel with information security responsibilities

organizational personnel with responsibility for the redundant secondary system

Test: Organizational processes for maintaining redundant secondary systems

mechanisms supporting and/or implementing system backups

mechanisms supporting and/or implementing information transfer to a redundant secondary system
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(6) > Assessment Objective

CP-9(6) Redundant Secondary System - Assessment Objective
Determine if the following are satisfied:

CP-09(06)[01] system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system;
CP-09(06)[02] system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(7) > Assessment Methods

CP-9(7) Dual Authorization for Deletion or Destruction - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

system design documentation

system configuration settings and associated documentation

system generated list of dual authorization credentials or rules

logs or records of deletion or destruction of backup information

system security plan

other relevant documents or records

Interview: Organizational personnel with system backup responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing dual authorization

mechanisms supporting and/or implementing the deletion/destruction of backup information
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(7) > Assessment Objective

CP-9(7) Dual Authorization for Deletion or Destruction - Assessment Objective
Determine if the following are satisfied:

dual authorization for the deletion or destruction of [Assignment: organization-defined backup information] is enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(8) > Assessment Methods

CP-9(8) Cryptographic Protection - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

system design documentation

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with system backup responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing cryptographic protection of backup information
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-9 > CP-9(8) > Assessment Objective

CP-9(8) Cryptographic Protection - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > Assessment Methods

CP-10 System Recovery and Reconstitution - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system backup

contingency plan

system backup test results

contingency plan test results

contingency plan test documentation

redundant secondary system for system backups

location(s) of redundant secondary backup system(s)

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes implementing system recovery and reconstitution operations

mechanisms supporting and/or implementing system recovery and reconstitution operations
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > Assessment Objective

CP-10 System Recovery and Reconstitution - Assessment Objective
Determine if the following are satisfied:

CP-10[01] the recovery of the system to a known state is provided within [Assignment: organization-defined time period] after a disruption, compromise, or failure;
CP-10[02] a reconstitution of the system to a known state is provided within [Assignment: organization-defined time period] after a disruption, compromise, or failure.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > CP-10(2) > Assessment Methods

CP-10(2) Transaction Recovery - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system recovery and reconstitution

contingency plan

system design documentation

system configuration settings and associated documentation

contingency plan test documentation

contingency plan test results

system transaction recovery records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibility for transaction recovery

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing transaction recovery capability
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > CP-10(2) > Assessment Objective

CP-10(2) Transaction Recovery - Assessment Objective
Determine if the following are satisfied:

transaction recovery is implemented for systems that are transaction-based.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > CP-10(4) > Assessment Methods

CP-10(4) Restore Within Time Period - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system recovery and reconstitution

contingency plan

system design documentation

system configuration settings and associated documentation

contingency plan test documentation

contingency plan test results

evidence of system recovery and reconstitution operations

system security plan

other relevant documents or records

Interview: Organizational personnel with system recovery and reconstitution responsibilities

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the recovery/reconstitution of system information
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > CP-10(4) > Assessment Objective

CP-10(4) Restore Within Time Period - Assessment Objective
Determine if the following are satisfied:

the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > CP-10(6) > Assessment Methods

CP-10(6) Component Protection - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing system recovery and reconstitution

contingency plan

system design documentation

system configuration settings and associated documentation

logical access credentials

physical access credentials

logical access authorization records

physical access authorization records

system security plan

other relevant documents or records

Interview: Organizational personnel with system recovery and reconstitution responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for protecting backup and restoration of hardware, firmware, and software

mechanisms supporting and/or implementing protection of backups and restoration of hardware, firmware, and software
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-10 > CP-10(6) > Assessment Objective

CP-10(6) Component Protection - Assessment Objective
Determine if the following are satisfied:

system components used for recovery and reconstitution are protected.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-11 > Assessment Methods

CP-11 Alternate Communications Protocols - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternative communications protocols

contingency plan

continuity of operations plan

system design documentation

system configuration settings and associated documentation

list of alternative communications protocols supporting continuity of operations

system security plan

other relevant documents or records

Interview: Organizational personnel with contingency planning and plan implementation responsibilities

organizational personnel with continuity of operations planning and plan implementation responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms employing alternative communications protocols
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-11 > Assessment Objective

CP-11 Alternate Communications Protocols - Assessment Objective
Determine if the following are satisfied:

the capability to employ [Assignment: organization-defined alternative communications protocols] are provided in support of maintaining continuity of operations.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-12 > Assessment Methods

CP-12 Safe Mode - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing safe mode of operation for the system

contingency plan

system design documentation

system configuration settings and associated documentation

system administration manuals

system operation manuals

system installation manuals

contingency plan test records

incident handling records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system operation responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms implementing safe mode of operation
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-12 > Assessment Objective

CP-12 Safe Mode - Assessment Objective
Determine if the following are satisfied:

a safe mode of operation is entered with [Assignment: organization-defined restrictions] when [Assignment: organization-defined conditions] are detected.
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-13 > Assessment Methods

CP-13 Alternative Security Mechanisms - Assessment Methods and Objects

Examine: Contingency planning policy

procedures addressing alternate security mechanisms

contingency plan

continuity of operations plan

system design documentation

system configuration settings and associated documentation

contingency plan test records

contingency plan test results

system security plan

other relevant documents or records

Interview: Organizational personnel with system operation responsibilities

organizational personnel with information security responsibilities

Test: system capability implementing alternative security mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
CP > CP-13 > Assessment Objective

CP-13 Alternative Security Mechanisms - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined alternative or supplemental security mechanisms] are employed for satisfying [Assignment: organization-defined security functions] when the primary means of implementing the security function is unavailable or compromised.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-1 > Assessment Methods

IA-1 Policy and Procedures - Assessment Methods and Objects

Examine: Identification and authentication policy and procedures

system security plan

privacy plan

risk management strategy documentation

list of events requiring identification and authentication procedures to be reviewed and updated (e.g., audit findings)

other relevant documents or records

Interview: Organizational personnel with identification and authentication responsibilities

organizational personnel with information security and privacy responsibilities