ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > Assessment Methods

AC-2 Account Management - Assessment Methods and Objects

Examine: Access control policy

personnel termination policy and procedure

personnel transfer policy and procedure

procedures for addressing account management

system design documentation

system configuration settings and associated documentation

list of active system accounts along with the name of the individual associated with each account

list of recently disabled system accounts and the name of the individual associated with each account

list of conditions for group and role membership

notifications of recent transfers, separations, or terminations of employees

access authorization records

account management compliance reviews

system monitoring records

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security with information security and privacy responsibilities

Test: Organizational processes for account management on the system

mechanisms for implementing account management
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > Assessment Objective

AC-2 Account Management - Assessment Objective
Determine if the following are satisfied:

AC-02a.[01] account types allowed for use within the system are defined and documented;
AC-02a.[02] account types specifically prohibited for use within the system are defined and documented;
AC-02b. account managers are assigned;
AC-02c. [Assignment: organization-defined prerequisites and criteria] for group and role membership are required;
AC-02d.01 authorized users of the system are specified;
AC-02d.02 group and role membership are specified;
AC-02d.03[01] access authorizations (i.e., privileges) are specified for each account;
AC-02d.03[02] [Assignment: organization-defined attributes (as required)] are specified for each account;
AC-02e. approvals are required by [Assignment: organization-defined personnel or roles] for requests to create accounts;
AC-02f.[01] accounts are created in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];
AC-02f.[02] accounts are enabled in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];
AC-02f.[03] accounts are modified in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];
AC-02f.[04] accounts are disabled in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];
AC-02f.[05] accounts are removed in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];
AC-02g. the use of accounts is monitored;
AC-02h.01 account managers and [Assignment: organization-defined personnel or roles] are notified within [Assignment: organization-defined time period] when accounts are no longer required;
AC-02h.02 account managers and [Assignment: organization-defined personnel or roles] are notified within [Assignment: organization-defined time period] when users are terminated or transferred;
AC-02h.03 account managers and [Assignment: organization-defined personnel or roles] are notified within [Assignment: organization-defined time period] when system usage or the need to know changes for an individual;
AC-02i.01 access to the system is authorized based on a valid access authorization;
AC-02i.02 access to the system is authorized based on intended system usage;
AC-02i.03 access to the system is authorized based on [Assignment: organization-defined attributes (as required)];
AC-02j. accounts are reviewed for compliance with account management requirements [Assignment: organization-defined frequency];
AC-02k.[01] a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
AC-02k.[02] a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
AC-02l.[01] account management processes are aligned with personnel termination processes;
AC-02l.[02] account management processes are aligned with personnel transfer processes.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(1) > Assessment Methods

AC-2(1) Automated System Account Management - Assessment Methods and Objects

Examine: Access control policy

procedures for addressing account management

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security with information security responsibilities

system developers

Test: Automated mechanisms for implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(1) > Assessment Objective

AC-2(1) Automated System Account Management - Assessment Objective
Determine if the following are satisfied:

the management of system accounts is supported using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(2) > Assessment Methods

AC-2(2) Automated Temporary and Emergency Account Management - Assessment Methods and Objects

Examine: Access control policy

procedures for addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of temporary accounts removed and/or disabled

system-generated list of emergency accounts removed and/or disabled

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security with information security responsibilities

system developers

Test: Automated mechanisms for implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(2) > Assessment Objective

AC-2(2) Automated Temporary and Emergency Account Management - Assessment Objective
Determine if the following are satisfied:

temporary and emergency accounts are automatically [Selection: remove; disable] after [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(3) > Assessment Methods

AC-2(3) Disable Accounts - Assessment Methods and Objects

Examine: Access control policy

procedures for addressing account management

system security plan

system design documentation

system configuration settings and associated documentation

system-generated list of accounts removed

system-generated list of emergency accounts disabled

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms for implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(3) > Assessment Objective

AC-2(3) Disable Accounts - Assessment Objective
Determine if the following are satisfied:

AC-02(03)(a) accounts are disabled within [Assignment: organization-defined time period] when the accounts have expired;
AC-02(03)(b) accounts are disabled within [Assignment: organization-defined time period] when the accounts are no longer associated with a user or individual;
AC-02(03)(c) accounts are disabled within [Assignment: organization-defined time period] when the accounts are in violation of organizational policy;
AC-02(03)(d) accounts are disabled within [Assignment: organization-defined time period] when the accounts have been inactive for [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(4) > Assessment Methods

AC-2(4) Automated Audit Actions - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

notifications/alerts of account creation, modification, enabling, disabling, and removal actions

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Automated mechanisms implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(4) > Assessment Objective

AC-2(4) Automated Audit Actions - Assessment Objective
Determine if the following are satisfied:

AC-02(04)[01] account creation is automatically audited;
AC-02(04)[02] account modification is automatically audited;
AC-02(04)[03] account enabling is automatically audited;
AC-02(04)[04] account disabling is automatically audited;
AC-02(04)[05] account removal actions are automatically audited.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(5) > Assessment Methods

AC-2(5) Inactivity Logout - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

security violation reports

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

users that must comply with inactivity logout policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(5) > Assessment Objective

AC-2(5) Inactivity Logout - Assessment Objective
Determine if the following are satisfied:

users are required to log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(6) > Assessment Methods

AC-2(6) Dynamic Privilege Management - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of dynamic privilege management capabilities

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: system or mechanisms implementing dynamic privilege management capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(6) > Assessment Objective

AC-2(6) Dynamic Privilege Management - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined dynamic privilege management capabilities] are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(7) > Assessment Methods

AC-2(7) Privileged User Accounts - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of privileged user accounts and associated roles

records of actions taken when privileged role assignments are no longer appropriate

system audit records

audit tracking and monitoring reports

system monitoring records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing account management functions

mechanisms monitoring privileged role assignments
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(7) > Assessment Objective

AC-2(7) Privileged User Accounts - Assessment Objective
Determine if the following are satisfied:

AC-02(07)(a) privileged user accounts are established and administered in accordance with [Selection: a role-based access scheme; an attribute-based access scheme];
AC-02(07)(b) privileged role or attribute assignments are monitored;
AC-02(07)(c) changes to roles or attributes are monitored;
AC-02(07)(d) access is revoked when privileged role or attribute assignments are no longer appropriate.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(8) > Assessment Methods

AC-2(8) Dynamic Account Management - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of system accounts

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Automated mechanisms implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(8) > Assessment Objective

AC-2(8) Dynamic Account Management - Assessment Objective
Determine if the following are satisfied:

AC-02(08)[01] [Assignment: organization-defined system accounts] are created dynamically;
AC-02(08)[02] [Assignment: organization-defined system accounts] are activated dynamically;
AC-02(08)[03] [Assignment: organization-defined system accounts] are managed dynamically;
AC-02(08)[04] [Assignment: organization-defined system accounts] are deactivated dynamically.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(9) > Assessment Methods

AC-2(9) Restrictions on Use of Shared and Group Accounts - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of shared/group accounts and associated roles

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing management of shared/group accounts
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(9) > Assessment Objective

AC-2(9) Restrictions on Use of Shared and Group Accounts - Assessment Objective
Determine if the following are satisfied:

the use of shared and group accounts is only permitted if [Assignment: organization-defined conditions] are met.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(11) > Assessment Methods

AC-2(11) Usage Conditions - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of system accounts and associated assignments of usage circumstances and/or usage conditions

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(11) > Assessment Objective

AC-2(11) Usage Conditions - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts] are enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(12) > Assessment Methods

AC-2(12) Account Monitoring for Atypical Usage - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system monitoring records

system audit records

audit tracking and monitoring reports

privacy impact assessment

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(12) > Assessment Objective

AC-2(12) Account Monitoring for Atypical Usage - Assessment Objective
Determine if the following are satisfied:

AC-02(12)(a) system accounts are monitored for [Assignment: organization-defined atypical usage];
AC-02(12)(b) atypical usage of system accounts is reported to [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(13) > Assessment Methods

AC-2(13) Disable Accounts for High-risk Individuals - Assessment Methods and Objects

Examine: Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of disabled accounts

list of user activities posing significant organizational risk

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing account management functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-2 > AC-2(13) > Assessment Objective

AC-2(13) Disable Accounts for High-risk Individuals - Assessment Objective
Determine if the following are satisfied:

accounts of individuals are disabled within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > Assessment Methods

AC-3 Access Enforcement - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of approved authorizations (user privileges)

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing access control policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > Assessment Objective

AC-3 Access Enforcement - Assessment Objective
Determine if the following are satisfied:

approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(2) > Assessment Methods

AC-3(2) Dual Authorization - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement and dual authorization

system design documentation

system configuration settings and associated documentation

list of privileged commands requiring dual authorization

list of actions requiring dual authorization

list of approved authorizations (user privileges)

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Dual authorization mechanisms implementing access control policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(2) > Assessment Objective

AC-3(2) Dual Authorization - Assessment Objective
Determine if the following are satisfied:

dual authorization is enforced for [Assignment: organization-defined privileged commands and/or other actions].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-3 > AC-3(3) > Assessment Methods

AC-3(3) Mandatory Access Control - Assessment Methods and Objects

Examine: Access control policy

mandatory access control policies

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Automated mechanisms implementing mandatory access control