ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-1 > Assessment Objective

IA-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

IA-01a.[01] an identification and authentication policy is developed and documented;
IA-01a.[02] the identification and authentication policy is disseminated to [Assignment: organization-defined personnel or roles];
IA-01a.[03] identification and authentication procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls are developed and documented;
IA-01a.[04] the identification and authentication procedures are disseminated to [Assignment: organization-defined personnel or roles];
IA-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy addresses purpose;
IA-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy addresses scope;
IA-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy addresses roles;
IA-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy addresses responsibilities;
IA-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy addresses management commitment;
IA-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy addresses coordination among organizational entities;
IA-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy addresses compliance;
IA-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] identification and authentication policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
IA-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures;
IA-01c.01[01] the current identification and authentication policy is reviewed and updated [Assignment: organization-defined frequency];
IA-01c.01[02] the current identification and authentication policy is reviewed and updated following [Assignment: organization-defined events];
IA-01c.02[01] the current identification and authentication procedures are reviewed and updated [Assignment: organization-defined frequency];
IA-01c.02[02] the current identification and authentication procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > Assessment Methods

IA-2 Identification and Authentication (Organizational Users) - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing user identification and authentication

system security plan, system design documentation

system configuration settings and associated documentation

system audit records

list of system accounts

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

organizational personnel with account management responsibilities

system developers

Test: Organizational processes for uniquely identifying and authenticating users

mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > Assessment Objective

IA-2 Identification and Authentication (Organizational Users) - Assessment Objective
Determine if the following are satisfied:

IA-02[01] organizational users are uniquely identified and authenticated;
IA-02[02] the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(1) > Assessment Methods

IA-2(1) Multi-factor Authentication to Privileged Accounts - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing user identification and authentication

system security plan

system design documentation

system configuration settings and associated documentation

system audit records

list of system accounts

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing a multi-factor authentication capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(1) > Assessment Objective

IA-2(1) Multi-factor Authentication to Privileged Accounts - Assessment Objective
Determine if the following are satisfied:

multi-factor authentication is implemented for access to privileged accounts.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(2) > Assessment Methods

IA-2(2) Multi-factor Authentication to Non-privileged Accounts - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of system accounts

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing a multi-factor authentication capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(2) > Assessment Objective

IA-2(2) Multi-factor Authentication to Non-privileged Accounts - Assessment Objective
Determine if the following are satisfied:

multi-factor authentication for access to non-privileged accounts is implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(5) > Assessment Methods

IA-2(5) Individual Authentication with Group Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of system accounts

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing an authentication capability for group accounts
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(5) > Assessment Objective

IA-2(5) Individual Authentication with Group Authentication - Assessment Objective
Determine if the following are satisfied:

users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(6) > Assessment Methods

IA-2(6) Access to Accounts -separate Device - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of system accounts

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing multi-factor authentication capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(6) > Assessment Objective

IA-2(6) Access to Accounts -separate Device - Assessment Objective
Determine if the following are satisfied:

IA-02(06)(a) multi-factor authentication is implemented for [Selection; one or more: local; network; remote] access to [Selection; one or more: privileged accounts; non-privileged accounts] such that one of the factors is provided by a device separate from the system gaining access;
IA-02(06)(b) multi-factor authentication is implemented for [Selection; one or more: local; network; remote] access to [Selection; one or more: privileged accounts; non-privileged accounts] such that the device meets [Assignment: organization-defined strength of mechanism requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(8) > Assessment Methods

IA-2(8) Access to Accounts - Replay Resistant - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of privileged system accounts

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing identification and authentication capabilities

Mechanisms supporting and/or implementing replay-resistant authentication mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(8) > Assessment Objective

IA-2(8) Access to Accounts - Replay Resistant - Assessment Objective
Determine if the following are satisfied:

replay-resistant authentication mechanisms for access to [Selection; one or more: privileged accounts; non-privileged accounts] are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(10) > Assessment Methods

IA-2(10) Single Sign-on - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing single sign-on capability for system accounts and services

procedures addressing identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of system accounts and services requiring single sign-on capability

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing identification and authentication capabilities

mechanisms supporting and/or implementing single sign-on capability for system accounts and services
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(10) > Assessment Objective

IA-2(10) Single Sign-on - Assessment Objective
Determine if the following are satisfied:

a single sign-on capability is provided for [Assignment: organization-defined system accounts and services].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(12) > Assessment Methods

IA-2(12) Acceptance of PIV Credentials - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

PIV verification records

evidence of PIV credentials

PIV credential authorizations

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing acceptance and verification of PIV credentials
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(12) > Assessment Objective

IA-2(12) Acceptance of PIV Credentials - Assessment Objective
Determine if the following are satisfied:

Personal Identity Verification-compliant credentials are accepted and electronically verified.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(13) > Assessment Methods

IA-2(13) Out-of-band Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

system-generated list of out-of-band authentication paths

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing out-of-band authentication capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-2 > IA-2(13) > Assessment Objective

IA-2(13) Out-of-band Authentication - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined out-of-band authentication] mechanisms are implemented under [Assignment: organization-defined conditions].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > Assessment Methods

IA-3 Device Identification and Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing device identification and authentication

system design documentation

list of devices requiring unique identification and authentication

device connection reports

system configuration settings and associated documentation

other relevant documents or records

Interview: Organizational personnel with operational responsibilities for device identification and authentication

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing device identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > Assessment Objective

IA-3 Device Identification and Authentication - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined devices and/or types of devices] are uniquely identified and authenticated before establishing a [Selection; one or more: local; remote; network] connection.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > IA-3(1) > Assessment Methods

IA-3(1) Cryptographic Bidirectional Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing device identification and authentication

system design documentation

list of devices requiring unique identification and authentication

device connection reports

system configuration settings and associated documentation

other relevant documents or records

Interview: Organizational personnel with operational responsibilities for device identification and authentication

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing device authentication capability

cryptographically based bidirectional authentication mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > IA-3(1) > Assessment Objective

IA-3(1) Cryptographic Bidirectional Authentication - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined devices and/or types of devices] are authenticated before establishing [Selection; one or more: local; remote; network] connection using bidirectional authentication that is cryptographically based.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > IA-3(3) > Assessment Methods

IA-3(3) Dynamic Address Allocation - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing device identification and authentication

system design documentation

system configuration settings and associated documentation

evidence of lease information and lease duration assigned to devices

device connection reports

system audit records

other relevant documents or records

Interview: Organizational personnel with operational responsibilities for device identification and authentication

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing device identification and authentication capabilities

mechanisms supporting and/or implementing dynamic address allocation

mechanisms supporting and/or implanting auditing of lease information
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > IA-3(3) > Assessment Objective

IA-3(3) Dynamic Address Allocation - Assessment Objective
Determine if the following are satisfied:

IA-03(03)(a)[01] dynamic address allocation lease information assigned to devices where addresses are allocated dynamically are standardized in accordance with [Assignment: organization-defined lease information];
IA-03(03)(a)[02] dynamic address allocation lease duration assigned to devices where addresses are allocated dynamically are standardized in accordance with [Assignment: organization-defined lease duration];
IA-03(03)(b) lease information is audited when assigned to a device.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > IA-3(4) > Assessment Methods

IA-3(4) Device Attestation - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing device identification and authentication

procedures addressing device configuration management

system design documentation

system configuration settings and associated documentation

configuration management records

change control records

system audit records

other relevant documents or records

Interview: Organizational personnel with operational responsibilities for device identification and authentication

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing device identification and authentication capabilities

mechanisms supporting and/or implementing configuration management

cryptographic mechanisms supporting device attestation
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-3 > IA-3(4) > Assessment Objective

IA-3(4) Device Attestation - Assessment Objective
Determine if the following are satisfied:

device identification and authentication are handled based on attestation by [Assignment: organization-defined configuration management process].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > Assessment Methods

IA-4 Identifier Management - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identifier management

procedures addressing account management

system security plan

system design documentation

system configuration settings and associated documentation

list of system accounts

list of identifiers generated from physical access control devices

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing identifier management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > Assessment Objective

IA-4 Identifier Management - Assessment Objective
Determine if the following are satisfied:

IA-04a. system identifiers are managed by receiving authorization from [Assignment: organization-defined personnel or roles] to assign to an individual, group, role, or device identifier;
IA-04b. system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device;
IA-04c. system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device;
IA-04d. system identifiers are managed by preventing reuse of identifiers for [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(1) > Assessment Methods

IA-4(1) Prohibit Account Identifiers as Public Identifiers - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing identifier management

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing identifier management
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(1) > Assessment Objective

IA-4(1) Prohibit Account Identifiers as Public Identifiers - Assessment Objective
Determine if the following are satisfied:

the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-4 > IA-4(4) > Assessment Methods

IA-4(4) Identify User Status - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing identifier management

procedures addressing account management

list of characteristics identifying individual status

other relevant documents or records

Interview: Organizational personnel with identifier management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing identifier management