ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(23) > Assessment Objective

SA-8(23) Secure Defaults - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of secure defaults.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(24) > Assessment Methods

SA-8(24) Secure Failure and Recovery - Assessment Methods and Objects

Examine: System and services acquisition policy

system and communications protection policy

contingency planning policy

procedures addressing information system recovery and reconstitution

procedures addressing the security design principle of secure failure and recovery used in the specification, design, development, implementation, and modification of the system

contingency plan

procedures addressing system backup

contingency plan test documentation

contingency plan test results

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

organizational personnel with contingency plan testing responsibilities

organizational personnel with system recovery and reconstitution responsibilities

system developers

organizational personnel with information security responsibilities

organizational personnel with information system backup responsibilities

Test: Organizational processes for applying the security design principle of secure failure and recovery in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of secure failure and recovery in system specification, design, development, implementation, and modification

mechanisms supporting and/or implementing secure failure

organizational processes for contingency plan testing

mechanisms supporting contingency plan testing

mechanisms supporting recovery and reconstitution of the system

organizational processes for conducting system backups

mechanisms supporting and/or implementing system backups
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(24) > Assessment Objective

SA-8(24) Secure Failure and Recovery - Assessment Objective
Determine if the following are satisfied:

SA-08(24)[01] [Assignment: organization-defined systems or system components] implement the security design principle of secure failure;
SA-08(24)[02] [Assignment: organization-defined systems or system components] implement the security design principle of secure recovery.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(25) > Assessment Methods

SA-8(25) Economic Security - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of economic security used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

cost-benefit analysis

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of economic security in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of economic security in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(25) > Assessment Objective

SA-8(25) Economic Security - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of economic security.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(26) > Assessment Methods

SA-8(26) Performance Security - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of performance security used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

trade-off analysis between performance and security

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of performance security in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of performance security in system specification, design, development, implementation, and modification
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(26) > Assessment Objective

SA-8(26) Performance Security - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of performance security.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(27) > Assessment Methods

SA-8(27) Human Factored Security - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of human factored security used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

usability analysis

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with human factored security responsibilities

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of human factored security in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of human factored security in system specification, design, development, implementation, and modification

mechanisms that enforce security policies
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(27) > Assessment Objective

SA-8(27) Human Factored Security - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of human factored security.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(28) > Assessment Methods

SA-8(28) Acceptable Security - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the security design principle of acceptable security used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

personally identifiable information processing policy

privacy notifications provided to users

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

Test: Organizational processes for applying the security design principle of acceptable security in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of acceptable security in system specification, design, development, implementation, and modification

mechanisms that enforce security policies
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(28) > Assessment Objective

SA-8(28) Acceptable Security - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of acceptable security.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(29) > Assessment Methods

SA-8(29) Repeatable and Documented Procedures - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of repeatable and documented procedures used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of repeatable and documented procedures in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of repeatable and documented procedures in system specification, design, development, implementation, and modification

mechanisms that enforce security policies
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(29) > Assessment Objective

SA-8(29) Repeatable and Documented Procedures - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of repeatable and documented procedures.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(30) > Assessment Methods

SA-8(30) Procedural Rigor - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of procedural rigor used in the specification, design, development, implementation, and modification of the system

system design documentation

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of procedural rigor in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of procedural rigor in system specification, design, development, implementation, and modification

mechanisms that enforce security policies
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(30) > Assessment Objective

SA-8(30) Procedural Rigor - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of procedural rigor.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(31) > Assessment Methods

SA-8(31) Secure System Modification - Assessment Methods and Objects

Examine: System and services acquisition policy

configuration management policy and procedures

procedures addressing the security design principle of secure system modification used in the specification, design, development, implementation, and modification of the system

system design documentation

system configuration settings and associated documentation

change control records

security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of secure system modification in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of secure system modification in system specification, design, development, implementation, and modification

mechanisms that enforce security policies

organizational processes for managing change configuration

mechanisms supporting configuration control
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(31) > Assessment Objective

SA-8(31) Secure System Modification - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of secure system modification.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(32) > Assessment Methods

SA-8(32) Sufficient Documentation - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the security design principle of sufficient documentation used in the specification, design, development, implementation, and modification of the system

system design documentation

system configuration settings and associated documentation

change control records

security and privacy requirements and specifications for the system

system security and privacy documentation

system security and privacy architecture

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for determining system security and privacy requirements

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

organizational personnel with information security responsibilities

Test: Organizational processes for applying the security design principle of sufficient documentation in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of sufficient documentation in system specification, design, development, implementation, and modification

mechanisms that enforce security policies

organizational processes for managing change configuration

mechanisms supporting configuration control
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(32) > Assessment Objective

SA-8(32) Sufficient Documentation - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] implement the security design principle of sufficient documentation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(33) > Assessment Methods

SA-8(33) Minimization - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

personally identifiable information processing policy

procedures addressing the minimization of personally identifiable information in system design

system design documentation

system configuration settings and associated documentation

change control records

information security and privacy requirements and specifications for the system

system security and privacy architecture

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

organizational personnel with system specification, design, development, implementation, and modification responsibilities

system developers

Test: Organizational processes for applying the privacy design principle of minimization in system specification, design, development, implementation, and modification

mechanisms supporting the application of the security design principle of sufficient documentation in system specification, design, development, implementation, and modification

mechanisms that enforce security and privacy policy

organizational processes for managing change configuration

mechanisms supporting configuration control
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-8 > SA-8(33) > Assessment Objective

SA-8(33) Minimization - Assessment Objective
Determine if the following are satisfied:

the privacy principle of minimization is implemented using [Assignment: organization-defined processes].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > Assessment Methods

SA-9 External System Services - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing methods and techniques for monitoring control compliance by external service providers of system services

acquisition documentation

contracts

service level agreements

interagency agreements

licensing agreements

list of organizational security and privacy requirements for external provider services

control assessment results or reports from external providers of system services

system security plan

privacy plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

external providers of system services

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis

mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > Assessment Objective

SA-9 External System Services - Assessment Objective
Determine if the following are satisfied:

SA-09a.[01] providers of external system services comply with organizational security requirements;
SA-09a.[02] providers of external system services comply with organizational privacy requirements;
SA-09a.[03] providers of external system services employ [Assignment: organization-defined controls];
SA-09b.[01] organizational oversight with regard to external system services are defined and documented;
SA-09b.[02] user roles and responsibilities with regard to external system services are defined and documented;
SA-09c. [Assignment: organization-defined processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(1) > Assessment Methods

SA-9(1) Risk Assessments and Organizational Approvals - Assessment Methods and Objects

Examine: System and services acquisition policy

supply chain risk management policy and procedures

procedures addressing external system services

acquisition documentation

acquisition contracts for the system, system component, or system service

risk assessment reports

approval records for the acquisition or outsourcing of dedicated security services

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with system security responsibilities

external providers of system services

organizational personnel with information security responsibilities

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for conducting a risk assessment prior to acquiring or outsourcing dedicated security services

organizational processes for approving the outsourcing of dedicated security services

mechanisms supporting and/or implementing risk assessment

mechanisms supporting and/or implementing approval processes
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(1) > Assessment Objective

SA-9(1) Risk Assessments and Organizational Approvals - Assessment Objective
Determine if the following are satisfied:

SA-09(01)(a) an organizational assessment of risk is conducted prior to the acquisition or outsourcing of information security services;
SA-09(01)(b) [Assignment: organization-defined personnel or roles] approve the acquisition or outsourcing of dedicated information security services.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(2) > Assessment Methods

SA-9(2) Identification of Functions, Ports, Protocols, and Services - Assessment Methods and Objects

Examine: System and services acquisition policy

supply chain risk management policy and procedures

procedures addressing external system services

acquisition contracts for the system, system component, or system service

acquisition documentation

solicitation documentation

service level agreements

organizational security requirements and security specifications for external service providers

list of required functions, ports, protocols, and other services

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

system/network administrators

external providers of system services