ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(6) > Assessment Methods

CM-3(6) Cryptography Management - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system configuration change control

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Test: Organizational processes for configuration change control

cryptographic mechanisms implementing organizational security safeguards (controls)
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(6) > Assessment Objective

CM-3(6) Cryptography Management - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms used to provide [Assignment: organization-defined controls] are under configuration management.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(7) > Assessment Methods

CM-3(7) Review System Changes - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system configuration change control

configuration management plan

change control records

system architecture and configuration documentation

system configuration settings and associated documentation

system audit records

system component inventory

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with security responsibilities

system/network administrators

members of change control board or similar

Test: Organizational processes for configuration change control

mechanisms implementing audit records for changes
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(7) > Assessment Objective

CM-3(7) Review System Changes - Assessment Objective
Determine if the following are satisfied:

changes to the system are reviewed [Assignment: organization-defined frequency] or when [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(8) > Assessment Methods

CM-3(8) Prevent or Restrict Configuration Changes - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system configuration change control

configuration management plan

change control records

system architecture and configuration documentation

system configuration settings and associated documentation

system component inventory

system audit records

system security plan

other relevant documents or records
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(8) > Assessment Objective

CM-3(8) Prevent or Restrict Configuration Changes - Assessment Objective
Determine if the following are satisfied:

changes to the configuration of the system are prevented or restricted under [Assignment: organization-defined circumstances].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-4 > Assessment Methods

CM-4 Impact Analyses - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing security impact analyses for changes to the system

procedures addressing privacy impact analyses for changes to the system

configuration management plan

security impact analysis documentation

privacy impact analysis documentation

privacy impact assessment

privacy risk assessment documentation, system design documentation

analysis tools and associated outputs

change control records

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibility for conducting security impact analyses

organizational personnel with responsibility for conducting privacy impact analyses

organizational personnel with information security and privacy responsibilities

system developer

system/network administrators

members of change control board or similar

Test: Organizational processes for security impact analyses

organizational processes for privacy impact analyses
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-4 > Assessment Objective

CM-4 Impact Analyses - Assessment Objective
Determine if the following are satisfied:

CM-04[01] changes to the system are analyzed to determine potential security impacts prior to change implementation;
CM-04[02] changes to the system are analyzed to determine potential privacy impacts prior to change implementation.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-4 > CM-4(1) > Assessment Methods

CM-4(1) Separate Test Environments - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing security impact analyses for changes to the system

procedures addressing privacy impact analyses for changes to the system

configuration management plan

security impact analysis documentation

privacy impact analysis documentation

privacy impact assessment

privacy risk assessment documentation

analysis tools and associated outputs system design documentation

system architecture and configuration documentation

change control records

procedures addressing the authority to test with PII

system audit records

documentation of separate test and operational environments

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibility for conducting security and privacy impact analyses

organizational personnel with information security and privacy responsibilities

system/network administrators

members of change control board or similar

Test: Organizational processes for security and privacy impact analyses

mechanisms supporting and/or implementing security and privacy impact analyses of changes
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-4 > CM-4(1) > Assessment Objective

CM-4(1) Separate Test Environments - Assessment Objective
Determine if the following are satisfied:

CM-04(01)[01] changes to the system are analyzed in a separate test environment before implementation in an operational environment;
CM-04(01)[02] changes to the system are analyzed for security impacts due to flaws;
CM-04(01)[03] changes to the system are analyzed for privacy impacts due to flaws;
CM-04(01)[04] changes to the system are analyzed for security impacts due to weaknesses;
CM-04(01)[05] changes to the system are analyzed for privacy impacts due to weaknesses;
CM-04(01)[06] changes to the system are analyzed for security impacts due to incompatibility;
CM-04(01)[07] changes to the system are analyzed for privacy impacts due to incompatibility;
CM-04(01)[08] changes to the system are analyzed for security impacts due to intentional malice;
CM-04(01)[09] changes to the system are analyzed for privacy impacts due to intentional malice.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-4 > CM-4(2) > Assessment Methods

CM-4(2) Verification of Controls - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing security impact analyses for changes to the system

procedures addressing privacy impact analyses for changes to the system

privacy risk assessment documentation

configuration management plan

security and privacy impact analysis documentation

privacy impact assessment

analysis tools and associated outputs

change control records

control assessment results

system audit records

system component inventory

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibility for conducting security and privacy impact analyses

organizational personnel with information security and privacy responsibilities

system/network administrators

security and privacy assessors

Test: Organizational processes for security and privacy impact analyses

mechanisms supporting and/or implementing security and privacy impact analyses of changes
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-4 > CM-4(2) > Assessment Objective

CM-4(2) Verification of Controls - Assessment Objective
Determine if the following are satisfied:

CM-04(02)[01] the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes;
CM-04(02)[02] the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes;
CM-04(02)[03] the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes;
CM-04(02)[04] the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes;
CM-04(02)[05] the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes;
CM-04(02)[06] the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > Assessment Methods

CM-5 Access Restrictions for Change - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing access restrictions for changes to the system

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

logical access approvals

physical access approvals

access credentials

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with logical access control responsibilities

organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing access restrictions to change

mechanisms supporting, implementing, or enforcing access restrictions associated with changes to the system
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > Assessment Objective

CM-5 Access Restrictions for Change - Assessment Objective
Determine if the following are satisfied:

CM-05[01] physical access restrictions associated with changes to the system are defined and documented;
CM-05[02] physical access restrictions associated with changes to the system are approved;
CM-05[03] physical access restrictions associated with changes to the system are enforced;
CM-05[04] logical access restrictions associated with changes to the system are defined and documented;
CM-05[05] logical access restrictions associated with changes to the system are approved;
CM-05[06] logical access restrictions associated with changes to the system are enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(1) > Assessment Methods

CM-5(1) Automated Access Enforcement and Audit Records - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing access restrictions for changes to the system

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with logical access control responsibilities

organizational personnel with physical access control responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing access restrictions to change

automated mechanisms implementing the enforcement of access restrictions for changes to the system

automated mechanisms supporting auditing of enforcement actions
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(1) > Assessment Objective

CM-5(1) Automated Access Enforcement and Audit Records - Assessment Objective
Determine if the following are satisfied:

CM-05(01)(a) access restrictions for change are enforced using [Assignment: organization-defined automated mechanisms];
CM-05(01)(b) audit records of enforcement actions are automatically generated.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(4) > Assessment Methods

CM-5(4) Dual Authorization - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing access restrictions for changes to the system

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

change control records

system audit records

system component inventory

system information types information

system security plan

other relevant documents or records

Interview: Organizational personnel with dual authorization enforcement responsibilities for implementing system changes

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing access restrictions to change

mechanisms implementing dual authorization enforcement
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(4) > Assessment Objective

CM-5(4) Dual Authorization - Assessment Objective
Determine if the following are satisfied:

CM-05(04)[01] dual authorization for implementing changes to [Assignment: organization-defined system components] is enforced;
CM-05(04)[02] dual authorization for implementing changes to [Assignment: organization-defined system-level information] is enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(5) > Assessment Methods

CM-5(5) Privilege Limitation for Production and Operation - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing access restrictions for changes to the system

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

user privilege reviews

user privilege recertifications

system component inventory

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing access restrictions to change

mechanisms supporting and/or implementing access restrictions for change
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(5) > Assessment Objective

CM-5(5) Privilege Limitation for Production and Operation - Assessment Objective
Determine if the following are satisfied:

CM-05(05)(a)[01] privileges to change system components within a production or operational environment are limited;
CM-05(05)(a)[02] privileges to change system-related information within a production or operational environment are limited;
CM-05(05)(b)[01] privileges are reviewed [Assignment: organization-defined frequency];
CM-05(05)(b)[02] privileges are reevaluated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(6) > Assessment Methods

CM-5(6) Limit Library Privileges - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing access restrictions for changes to the system

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

system component inventory

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing access restrictions to change

mechanisms supporting and/or implementing access restrictions for change
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-5 > CM-5(6) > Assessment Objective

CM-5(6) Limit Library Privileges - Assessment Objective
Determine if the following are satisfied:

privileges to change software resident within software libraries are limited.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-6 > Assessment Methods

CM-6 Configuration Settings - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing configuration settings for the system

configuration management plan

system design documentation

system configuration settings and associated documentation

common secure configuration checklists

system component inventory

evidence supporting approved deviations from established configuration settings

change control records

system data processing and retention permissions

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security configuration management responsibilities

organizational personnel with privacy configuration management responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Organizational processes for managing configuration settings

mechanisms that implement, monitor, and/or control system configuration settings

mechanisms that identify and/or document deviations from established configuration settings
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-6 > Assessment Objective

CM-6 Configuration Settings - Assessment Objective
Determine if the following are satisfied:

CM-06a. configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [Assignment: organization-defined common secure configurations];
CM-06b. the configuration settings documented in CM-06a are implemented;
CM-06c.[01] any deviations from established configuration settings for [Assignment: organization-defined system components] are identified and documented based on [Assignment: organization-defined operational requirements];
CM-06c.[02] any deviations from established configuration settings for [Assignment: organization-defined system components] are approved;
CM-06d.[01] changes to the configuration settings are monitored in accordance with organizational policies and procedures;
CM-06d.[02] changes to the configuration settings are controlled in accordance with organizational policies and procedures.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-6 > CM-6(1) > Assessment Methods

CM-6(1) Automated Management, Application, and Verification - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing configuration settings for the system

configuration management plan

system design documentation

system configuration settings and associated documentation

system component inventory

common secure configuration checklists

change control records

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security configuration management responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Organizational processes for managing configuration settings

automated mechanisms implemented to manage, apply, and verify system configuration settings
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-6 > CM-6(1) > Assessment Objective

CM-6(1) Automated Management, Application, and Verification - Assessment Objective
Determine if the following are satisfied:

CM-06(01)[01] configuration settings for [Assignment: organization-defined system components] are managed using [Assignment: organization-defined automated mechanisms];
CM-06(01)[02] configuration settings for [Assignment: organization-defined system components] are applied using [Assignment: organization-defined automated mechanisms];
CM-06(01)[03] configuration settings for [Assignment: organization-defined system components] are verified using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-6 > CM-6(2) > Assessment Methods

CM-6(2) Respond to Unauthorized Changes - Assessment Methods and Objects

Examine: System security plan

privacy plan

configuration management policy

procedures addressing configuration settings for the system

configuration management plan

system design documentation

system configuration settings and associated documentation

alerts/notifications of unauthorized changes to system configuration settings

system component inventory

documented responses to unauthorized changes to system configuration settings

change control records

system audit records

other relevant documents or records

Interview: Organizational personnel with security configuration management responsibilities

organizational personnel with security and privacy responsibilities

system/network administrators

Test: Organizational process for responding to unauthorized changes to system configuration settings

mechanisms supporting and/or implementing actions in response to unauthorized changes
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-6 > CM-6(2) > Assessment Objective

CM-6(2) Respond to Unauthorized Changes - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined actions] are taken in response to unauthorized changes to [Assignment: organization-defined configuration settings].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-7 > Assessment Methods

CM-7 Least Functionality - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

system component inventory

common secure configuration checklists

system security plan

other relevant documents or records

Interview: Organizational personnel with security configuration management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Organizational processes prohibiting or restricting functions, ports, protocols, software, and/or services

mechanisms implementing restrictions or prohibition of functions, ports, protocols, software, and/or services