ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(3) > Assessment Objective

AC-3(3) Mandatory Access Control - Assessment Objective
Determine if the following are satisfied:

AC-03(03)[01] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
AC-03(03)[02] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered objects specified in the policy;
AC-03(03)(a)[01] [Assignment: organization-defined mandatory access control policy] is uniformly enforced across the covered subjects within the system;
AC-03(03)(a)[02] [Assignment: organization-defined mandatory access control policy] is uniformly enforced across the covered objects within the system;
AC-03(03)(b)(01) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects are enforced;
AC-03(03)(b)(02) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from granting its privileges to other subjects are enforced;
AC-03(03)(b)(03) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from changing one of more security attributes (specified by the policy) on subjects, objects, the system, or system components are enforced;
AC-03(03)(b)(04) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects are enforced;
AC-03(03)(b)(05) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that a subject that has been granted access to information is constrained from changing the rules governing access control are enforced;
AC-03(03)(c) [Assignment: organization-defined mandatory access control policy] and [Assignment: organization-defined mandatory access control policy] specifying that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints are enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(4) > Assessment Methods

AC-3(4) Discretionary Access Control - Assessment Methods and Objects

Examine: Access control policy

discretionary access control policies

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing discretionary access control policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(4) > Assessment Objective

AC-3(4) Discretionary Access Control - Assessment Objective
Determine if the following are satisfied:

AC-03(04)[01] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
AC-03(04)[02] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered objects specified in the policy;
AC-03(04)(a) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects;
AC-03(04)(b) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects;
AC-03(04)(c) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system's components;
AC-03(04)(d) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects;
AC-03(04)(e) [Assignment: organization-defined discretionary access control policy] and [Assignment: organization-defined discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can change the rules governing access control.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(5) > Assessment Methods

AC-3(5) Security-relevant Information - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms preventing access to security-relevant information within the system
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(5) > Assessment Objective

AC-3(5) Security-relevant Information - Assessment Objective
Determine if the following are satisfied:

access to [Assignment: organization-defined security-relevant information] is prevented except during secure, non-operable system states.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(7) > Assessment Methods

AC-3(7) Role-based Access Control - Assessment Methods and Objects

Examine: Access control policy

role-based access control policies

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of roles, users, and associated privileges required to control system access

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing role-based access control policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(7) > Assessment Objective

AC-3(7) Role-based Access Control - Assessment Objective
Determine if the following are satisfied:

AC-03(07)[01] a role-based access control policy is enforced over defined subjects;
AC-03(07)[02] a role-based access control policy is enforced over defined objects;
AC-03(07)[03] access is controlled based on [Assignment: organization-defined roles] and [Assignment: organization-defined users authorized to assume such roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(8) > Assessment Methods

AC-3(8) Revocation of Access Authorizations - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

rules governing revocation of access authorizations, system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(8) > Assessment Objective

AC-3(8) Revocation of Access Authorizations - Assessment Objective
Determine if the following are satisfied:

AC-03(08)[01] revocation of access authorizations is enforced, resulting from changes to the security attributes of subjects based on [Assignment: organization-defined rules];
AC-03(08)[02] revocation of access authorizations is enforced resulting from changes to the security attributes of objects based on [Assignment: organization-defined rules].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(9) > Assessment Methods

AC-3(9) Controlled Release - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of security and privacy safeguards provided by receiving system or system components

list of security and privacy safeguards validating appropriateness of information designated for release

system audit records

results of period assessments (inspections/tests) of the external system

information sharing agreements

memoranda of understanding

acquisitions/contractual agreements

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security and privacy responsibilities

organizational personnel with responsibility for acquisitions/contractual agreements

legal counsel

system developers

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(9) > Assessment Objective

AC-3(9) Controlled Release - Assessment Objective
Determine if the following are satisfied:

AC-03(09)(a) information is released outside of the system only if the receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls];
AC-03(09)(b) information is released outside of the system only if [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(10) > Assessment Methods

AC-3(10) Audited Override of Access Control Mechanisms - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

conditions for employing audited override of automated access control mechanisms

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(10) > Assessment Objective

AC-3(10) Audited Override of Access Control Mechanisms - Assessment Objective
Determine if the following are satisfied:

an audited override of automated access control mechanisms is employed under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(11) > Assessment Methods

AC-3(11) Restrict Access to Specific Information Types - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

organizational personnel with responsibilities for data repositories

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(11) > Assessment Objective

AC-3(11) Restrict Access to Specific Information Types - Assessment Objective
Determine if the following are satisfied:

access to data repositories containing [Assignment: organization-defined information types] is restricted.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(12) > Assessment Methods

AC-3(12) Assert and Enforce Application Access - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(12) > Assessment Objective

AC-3(12) Assert and Enforce Application Access - Assessment Objective
Determine if the following are satisfied:

AC-03(12)(a) as part of the installation process, applications are required to assert the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions];
AC-03(12)(b) an enforcement mechanism to prevent unauthorized access is provided;
AC-03(12)(c) access changes after initial installation of the application are approved.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(13) > Assessment Methods

AC-3(13) Attribute-based Access Control - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(13) > Assessment Objective

AC-3(13) Attribute-based Access Control - Assessment Objective
Determine if the following are satisfied:

AC-03(13)[01] the attribute-based access control policy is enforced over defined subjects;
AC-03(13)[02] the attribute-based access control policy is enforced over defined objects;
AC-03(13)[03] access is controlled based on [Assignment: organization-defined attributes].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(14) > Assessment Methods

AC-3(14) Individual Access - Assessment Methods and Objects

Examine: Access mechanisms (e.g., request forms and application interfaces)

access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

documentation regarding access to an individual's personally identifiable information

system audit records

system security plan

privacy plan

privacy impact assessment

privacy assessment findings and/or reports

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security and privacy responsibilities

legal counsel

Test: Mechanisms implementing access enforcement functions

mechanisms enabling individual access to personally identifiable information
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(14) > Assessment Objective

AC-3(14) Individual Access - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined mechanisms] are provided to enable individuals to have access to [Assignment: organization-defined elements] of their personally identifiable information.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(15) > Assessment Methods

AC-3(15) Discretionary and Mandatory Access Control - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies

list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing mandatory and discretionary access control policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(15) > Assessment Objective

AC-3(15) Discretionary and Mandatory Access Control - Assessment Objective
Determine if the following are satisfied:

AC-03(15)(a)[01] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
AC-03(15)(a)[02] [Assignment: organization-defined mandatory access control policy] is enforced over the set of covered objects specified in the policy;
AC-03(15)(b)[01] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
AC-03(15)(b)[02] [Assignment: organization-defined discretionary access control policy] is enforced over the set of covered objects specified in the policy.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > Assessment Methods

AC-4 Information Flow Enforcement - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

security architecture documentation

privacy architecture documentation

system design documentation

system configuration settings and associated documentation

system baseline configuration

list of information flow authorizations

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy architecture development responsibilities

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > Assessment Objective

AC-4 Information Flow Enforcement - Assessment Objective
Determine if the following are satisfied:

approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(1) > Assessment Methods

AC-4(1) Object Security and Privacy Attributes - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of security and privacy attributes and associated source and destination objects

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(1) > Assessment Objective

AC-4(1) Object Security and Privacy Attributes - Assessment Objective
Determine if the following are satisfied:

AC-04(01)[01] [Assignment: organization-defined security attributes] associated with [Assignment: organization-defined information objects], [Assignment: organization-defined source objects] , and [Assignment: organization-defined destination objects] are used to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions;
AC-04(01)[02] [Assignment: organization-defined privacy attributes] associated with [Assignment: organization-defined information objects], [Assignment: organization-defined source objects] , and [Assignment: organization-defined destination objects] are used to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(2) > Assessment Methods

AC-4(2) Processing Domains - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system security architecture and associated documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(2) > Assessment Objective

AC-4(2) Processing Domains - Assessment Objective
Determine if the following are satisfied:

protected processing domains are used to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.