ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
IR > IR-5 > Discussion

IR-5 Incident Monitoring - Discussion
Family: Incident Response (IR)

Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [IR-4](#ir-4) provides information on the types of incidents that are appropriate for monitoring.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-5 > IR-5(1) > Discussion

IR-5(1) Automated Tracking, Data Collection, and Analysis - Discussion
Family: Incident Response (IR) > IR-5 Incident Monitoring

Automated mechanisms for tracking incidents and collecting and analyzing incident information include Computer Incident Response Centers or other electronic databases of incidents and network monitoring devices.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-5 > IR-5(1)

IR-5(1) Incident Monitoring | Automated Tracking, Data Collection, and Analysis
Family: Incident Response (IR) > IR-5 Incident Monitoring

Track incidents and collect and analyze incident information using [Assignment: organization-defined organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6

IR-6 Incident Reporting
Family: Incident Response (IR)

a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period] ; and
b. Report incident information to [Assignment: organization-defined authorities].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6 > Discussion

IR-6 Incident Reporting - Discussion
Family: Incident Response (IR)

The types of incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Incident information can inform risk assessments, control effectiveness assessments, security requirements for acquisitions, and selection criteria for technology products.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6 > IR-6(1) > Discussion

IR-6(1) Automated Reporting - Discussion
Family: Incident Response (IR) > IR-6 Incident Reporting

The recipients of incident reports are specified in [IR-6b](#ir-6_smt.b) . Automated reporting mechanisms include email, posting on websites (with automatic updates), and automated incident response tools and programs.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6 > IR-6(1)

IR-6(1) Incident Reporting | Automated Reporting
Family: Incident Response (IR) > IR-6 Incident Reporting

Report incidents using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6 > IR-6(2) > Discussion

IR-6(2) Vulnerabilities Related to Incidents - Discussion
Family: Incident Response (IR) > IR-6 Incident Reporting

Reported incidents that uncover system vulnerabilities are analyzed by organizational personnel including system owners, mission and business owners, senior agency information security officers, senior agency officials for privacy, authorizing officials, and the risk executive (function). The analysis can serve to prioritize and initiate mitigation actions to address the discovered system vulnerability.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6 > IR-6(2)

IR-6(2) Incident Reporting | Vulnerabilities Related to Incidents
Family: Incident Response (IR) > IR-6 Incident Reporting

Report system vulnerabilities associated with reported incidents to [Assignment: organization-defined personnel or roles].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6 > IR-6(3) > Discussion

IR-6(3) Supply Chain Coordination - Discussion
Family: Incident Response (IR) > IR-6 Incident Reporting

Organizations involved in supply chain activities include product developers, system integrators, manufacturers, packagers, assemblers, distributors, vendors, and resellers. Entities that provide supply chain governance include the Federal Acquisition Security Council (FASC). Supply chain incidents include compromises or breaches that involve information technology products, system components, development processes or personnel, distribution processes, or warehousing facilities. Organizations determine the appropriate information to share and consider the value gained from informing external organizations about supply chain incidents, including the ability to improve processes or to identify the root cause of an incident.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-6 > IR-6(3)

IR-6(3) Incident Reporting | Supply Chain Coordination
Family: Incident Response (IR) > IR-6 Incident Reporting

Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-7

IR-7 Incident Response Assistance
Family: Incident Response (IR)

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-7 > Discussion

IR-7 Incident Response Assistance - Discussion
Family: Incident Response (IR)

Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensics services or consumer redress services, when required.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-7 > IR-7(1) > Discussion

IR-7(1) Automation Support for Availability of Information and Support - Discussion
Family: Incident Response (IR) > IR-7 Incident Response Assistance

Automated mechanisms can provide a push or pull capability for users to obtain incident response assistance. For example, individuals may have access to a website to query the assistance capability, or the assistance capability can proactively send incident response information to users (general distribution or targeted) as part of increasing understanding of current response capabilities and support.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-7 > IR-7(1)

IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support
Family: Incident Response (IR) > IR-7 Incident Response Assistance

Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-7 > IR-7(2) > Discussion

IR-7(2) Coordination with External Providers - Discussion
Family: Incident Response (IR) > IR-7 Incident Response Assistance

External providers of a system protection capability include the Computer Network Defense program within the U.S. Department of Defense. External providers help to protect, monitor, analyze, detect, and respond to unauthorized activity within organizational information systems and networks. It may be beneficial to have agreements in place with external providers to clarify the roles and responsibilities of each party before an incident occurs.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-7 > IR-7(2)

IR-7(2) Incident Response Assistance | Coordination with External Providers
Family: Incident Response (IR) > IR-7 Incident Response Assistance

(a) Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability; and
(b) Identify organizational incident response team members to the external providers.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-8

IR-8 Incident Response Plan
Family: Incident Response (IR)

a. Develop an incident response plan that:
1. Provides the organization with a roadmap for implementing its incident response capability;
2. Describes the structure and organization of the incident response capability;
3. Provides a high-level approach for how the incident response capability fits into the overall organization;
4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
5. Defines reportable incidents;
6. Provides metrics for measuring the incident response capability within the organization;
7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
8. Addresses the sharing of incident information;
9. Is reviewed and approved by [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency] ; and
10. Explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles].
b. Distribute copies of the incident response plan to [Assignment: organization-defined incident response personnel];
c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
d. Communicate incident response plan changes to [Assignment: organization-defined organization-defined incident response personnel (identified by name and/or by role) and organizational elements] ; and
e. Protect the incident response plan from unauthorized disclosure and modification.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-8 > Discussion

IR-8 Incident Response Plan - Discussion
Family: Incident Response (IR)

It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain. For incidents involving personally identifiable information (i.e., breaches), include a process to determine whether notice to oversight organizations or affected individuals is appropriate and provide that notice accordingly.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-8 > IR-8(1) > Discussion

IR-8(1) Breaches - Discussion
Family: Incident Response (IR) > IR-8 Incident Response Plan

Organizations may be required by law, regulation, or policy to follow specific procedures relating to breaches, including notice to individuals, affected organizations, and oversight bodies; standards of harm; and mitigation or other specific requirements.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-8 > IR-8(1)

IR-8(1) Incident Response Plan | Breaches
Family: Incident Response (IR) > IR-8 Incident Response Plan

Include the following in the Incident Response Plan for breaches involving personally identifiable information:
(a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
(b) An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and
(c) Identification of applicable privacy requirements.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9

IR-9 Information Spillage Response
Family: Incident Response (IR)

Respond to information spills by:
a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills;
b. Identifying the specific information involved in the system contamination;
c. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
d. Isolating the contaminated system or system component;
e. Eradicating the information from the contaminated system or component;
f. Identifying other systems or system components that may have been subsequently contaminated; and
g. Performing the following additional actions: [Assignment: organization-defined actions].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9 > Discussion

IR-9 Information Spillage Response - Discussion
Family: Incident Response (IR)

Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9 > IR-9(2) > Discussion

IR-9(2) Training - Discussion
Family: Incident Response (IR) > IR-9 Information Spillage Response

Organizations establish requirements for responding to information spillage incidents in incident response plans. Incident response training on a regular basis helps to ensure that organizational personnel understand their individual responsibilities and what specific actions to take when spillage incidents occur.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9 > IR-9(2)

IR-9(2) Information Spillage Response | Training
Family: Incident Response (IR) > IR-9 Information Spillage Response

Provide information spillage response training [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9 > IR-9(3) > Discussion

IR-9(3) Post-spill Operations - Discussion
Family: Incident Response (IR) > IR-9 Information Spillage Response

Corrective actions for systems contaminated due to information spillages may be time-consuming. Personnel may not have access to the contaminated systems while corrective actions are being taken, which may potentially affect their ability to conduct organizational business.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9 > IR-9(3)

IR-9(3) Information Spillage Response | Post-spill Operations
Family: Incident Response (IR) > IR-9 Information Spillage Response

Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment: organization-defined procedures].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9 > IR-9(4) > Discussion

IR-9(4) Exposure to Unauthorized Personnel - Discussion
Family: Incident Response (IR) > IR-9 Information Spillage Response

Controls include ensuring that personnel who are exposed to spilled information are made aware of the laws, executive orders, directives, regulations, policies, standards, and guidelines regarding the information and the restrictions imposed based on exposure to such information.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-9 > IR-9(4)

IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel
Family: Incident Response (IR) > IR-9 Information Spillage Response

Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls].
Security and Privacy Controls for Information Systems and Organizations
MA > MA-1

MA-1 Policy and Procedures
Family: Maintenance (MA)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] maintenance policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
c. Review and update the current maintenance:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
MA > MA-1 > Discussion

MA-1 Policy and Procedures - Discussion
Family: Maintenance (MA)

Maintenance policy and procedures address the controls in the MA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of maintenance policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to maintenance policy and procedures assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-2

MA-2 Controlled Maintenance
Family: Maintenance (MA)

a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
c. Require that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information];
e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
f. Include the following information in organizational maintenance records: [Assignment: organization-defined information].
Security and Privacy Controls for Information Systems and Organizations
MA > MA-2 > Discussion

MA-2 Controlled Maintenance - Discussion
Family: Maintenance (MA)

Controlling system maintenance addresses the information security aspects of the system maintenance program and applies to all types of maintenance to system components conducted by local or nonlocal entities. Maintenance includes peripherals such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes the date and time of maintenance, a description of the maintenance performed, names of the individuals or group performing the maintenance, name of the escort, and system components or equipment that are removed or replaced. Organizations consider supply chain-related risks associated with replacement components for systems.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-2 > MA-2(2) > Discussion

MA-2(2) Automated Maintenance Activities - Discussion
Family: Maintenance (MA) > MA-2 Controlled Maintenance

The use of automated mechanisms to manage and control system maintenance programs and activities helps to ensure the generation of timely, accurate, complete, and consistent maintenance records.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-2 > MA-2(2)

MA-2(2) Controlled Maintenance | Automated Maintenance Activities
Family: Maintenance (MA) > MA-2 Controlled Maintenance

(a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [Assignment: organization-defined organization-defined automated mechanisms] ; and
(b) Produce up-to date, accurate, and complete records of all maintenance, repair, and replacement actions requested, scheduled, in process, and completed.
Security and Privacy Controls for Information Systems and Organizations
MA > MA-3

MA-3 Maintenance Tools
Family: Maintenance (MA)

a. Approve, control, and monitor the use of system maintenance tools; and
b. Review previously approved system maintenance tools [Assignment: organization-defined frequency].