ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-5 > MP-5(3) > Assessment Objective

MP-5(3) Custodians - Assessment Objective
Determine if the following are satisfied:

MP-05(03)[01] a custodian to transport system media outside of controlled areas is identified;
MP-05(03)[02] the identified custodian is employed during the transport of system media outside of controlled areas.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > Assessment Methods

MP-6 Media Sanitization - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media sanitization and disposal

applicable federal standards and policies addressing media sanitization policy

media sanitization records

system audit records

system design documentation

records retention and disposition policy

records retention and disposition procedures

system configuration settings and associated documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with media sanitization responsibilities

organizational personnel with records retention and disposition responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Organizational processes for media sanitization

mechanisms supporting and/or implementing media sanitization
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > Assessment Objective

MP-6 Media Sanitization - Assessment Objective
Determine if the following are satisfied:

MP-06a.[01] [Assignment: organization-defined system media] is sanitized using [Assignment: organization-defined sanitization techniques and procedures] prior to disposal;
MP-06a.[02] [Assignment: organization-defined system media] is sanitized using [Assignment: organization-defined sanitization techniques and procedures] prior to release from organizational control;
MP-06a.[03] [Assignment: organization-defined system media] is sanitized using [Assignment: organization-defined sanitization techniques and procedures] prior to release for reuse;
MP-06b. sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(1) > Assessment Methods

MP-6(1) Review, Approve, Track, Document, and Verify - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media sanitization and disposal

records retention and disposition policy

records retention and disposition procedures

media sanitization and disposal records

review records for media sanitization and disposal actions

approvals for media sanitization and disposal actions

tracking records

verification records

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system media sanitization and disposal responsibilities

organizational personnel with records retention and disposition responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Organizational processes for media sanitization

mechanisms supporting and/or implementing media sanitization

mechanisms supporting and/or implementing verification of media sanitization
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(1) > Assessment Objective

MP-6(1) Review, Approve, Track, Document, and Verify - Assessment Objective
Determine if the following are satisfied:

MP-06(01)[01] media sanitization and disposal actions are reviewed;
MP-06(01)[02] media sanitization and disposal actions are approved;
MP-06(01)[03] media sanitization and disposal actions are tracked;
MP-06(01)[04] media sanitization and disposal actions are documented;
MP-06(01)[05] media sanitization and disposal actions are verified.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(2) > Assessment Methods

MP-6(2) Equipment Testing - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media sanitization and disposal

procedures addressing testing of media sanitization equipment

results of media sanitization equipment and procedures testing

system audit records

records retention and disposition policy

records retention and disposition procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system media sanitization responsibilities

organizational personnel with records retention and disposition responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for media sanitization

automated mechanisms supporting and/or implementing media sanitization

automated mechanisms supporting and/or implementing media sanitization procedures

sanitization equipment
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(2) > Assessment Objective

MP-6(2) Equipment Testing - Assessment Objective
Determine if the following are satisfied:

MP-06(02)[01] sanitization equipment is tested [Assignment: organization-defined frequency] to ensure that the intended sanitization is being achieved;
MP-06(02)[02] sanitization procedures are tested [Assignment: organization-defined frequency] to ensure that the intended sanitization is being achieved.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(3) > Assessment Methods

MP-6(3) Nondestructive Techniques - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media sanitization and disposal

information on portable storage devices for the system

list of circumstances requiring sanitization of portable storage devices

media sanitization records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media sanitization responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for media sanitization of portable storage devices

mechanisms supporting and/or implementing media sanitization
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(3) > Assessment Objective

MP-6(3) Nondestructive Techniques - Assessment Objective
Determine if the following are satisfied:

non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under [Assignment: organization-defined circumstances].
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(7) > Assessment Methods

MP-6(7) Dual Authorization - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media sanitization and disposal

dual authorization policy and procedures

list of system media requiring dual authorization for sanitization

authorization records

media sanitization records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media sanitization responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes requiring dual authorization for media sanitization

mechanisms supporting and/or implementing media sanitization

mechanisms supporting and/or implementing dual authorization
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(7) > Assessment Objective

MP-6(7) Dual Authorization - Assessment Objective
Determine if the following are satisfied:

dual authorization for sanitization of [Assignment: organization-defined system media] is enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(8) > Assessment Methods

MP-6(8) Remote Purging or Wiping of Information - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media sanitization and disposal

system design documentation

system configuration settings and associated documentation

authorization records

media sanitization records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media sanitization responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for purging/wiping media

mechanisms supporting and/or implementing purge/wipe capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-6 > MP-6(8) > Assessment Objective

MP-6(8) Remote Purging or Wiping of Information - Assessment Objective
Determine if the following are satisfied:

the capability to purge or wipe information from [Assignment: organization-defined systems or system components] [Selection: remotely; under [Assignment: organization-defined conditions] ] is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-7 > Assessment Methods

MP-7 Media Use - Assessment Methods and Objects

Examine: System media protection policy

system use policy

procedures addressing media usage restrictions

rules of behavior

system design documentation

system configuration settings and associated documentation

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media use responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for media use

mechanisms restricting or prohibiting the use of system media on systems or system components
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-7 > Assessment Objective

MP-7 Media Use - Assessment Objective
Determine if the following are satisfied:

MP-07a. the use of [Assignment: organization-defined types of system media] is [Selection: restrict; prohibit] on [Assignment: organization-defined systems or system components] using [Assignment: organization-defined controls];
MP-07b. the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-7 > MP-7(2) > Assessment Methods

MP-7(2) Prohibit Use of Sanitization-resistant Media - Assessment Methods and Objects

Examine: System media protection policy

system use policy

procedures addressing media usage restrictions

rules of behavior

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with system media use responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for media use

mechanisms prohibiting use of media on systems or system components
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-7 > MP-7(2) > Assessment Objective

MP-7(2) Prohibit Use of Sanitization-resistant Media - Assessment Objective
Determine if the following are satisfied:

MP-07(02)[01] sanitization-resistant media is identified;
MP-07(02)[02] the use of sanitization-resistant media in organizational systems is prohibited.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > Assessment Methods

MP-8 Media Downgrading - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media downgrading

system categorization documentation

list of media requiring downgrading

records of media downgrading

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media downgrading responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for media downgrading

mechanisms supporting and/or implementing media downgrading
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > Assessment Objective

MP-8 Media Downgrading - Assessment Objective
Determine if the following are satisfied:

MP-08a.[01] a [Assignment: organization-defined system media downgrading process] is established;
MP-08a.[02] the [Assignment: organization-defined system media downgrading process] includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;
MP-08b.[01] there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed;
MP-08b.[02] there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information;
MP-08c. [Assignment: organization-defined system media requiring downgrading] is identified;
MP-08d. the identified system media is downgraded using the [Assignment: organization-defined system media downgrading process].
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(1) > Assessment Methods

MP-8(1) Documentation of Process - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media downgrading

system categorization documentation

list of media requiring downgrading

records of media downgrading

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media downgrading responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for media downgrading

mechanisms supporting and/or implementing media downgrading
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(1) > Assessment Objective

MP-8(1) Documentation of Process - Assessment Objective
Determine if the following are satisfied:

system media downgrading actions are documented.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(2) > Assessment Methods

MP-8(2) Equipment Testing - Assessment Methods and Objects

Examine: System media protection policy

procedures addressing media downgrading

procedures addressing testing of media downgrading equipment

results of downgrading equipment and procedures testing

records of media downgrading

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media downgrading responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for media downgrading

mechanisms supporting and/or implementing media downgrading
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(2) > Assessment Objective

MP-8(2) Equipment Testing - Assessment Objective
Determine if the following are satisfied:

MP-08(02)[01] downgrading equipment is tested [Assignment: organization-defined frequency] to ensure that downgrading actions are being achieved;
MP-08(02)[02] downgrading procedures are tested [Assignment: organization-defined frequency] to ensure that downgrading actions are being achieved.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(3) > Assessment Methods

MP-8(3) Controlled Unclassified Information - Assessment Methods and Objects

Examine: System media protection policy

access authorization policy

procedures addressing downgrading of media containing CUI

applicable federal and organizational standards and policies regarding protection of CUI

media downgrading records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media downgrading responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for media downgrading

mechanisms supporting and/or implementing media downgrading
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(3) > Assessment Objective

MP-8(3) Controlled Unclassified Information - Assessment Objective
Determine if the following are satisfied:

MP-08(03)[01] system media containing controlled unclassified information is identified;
MP-08(03)[02] system media containing controlled unclassified information is downgraded prior to public release.
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(4) > Assessment Methods

MP-8(4) Classified Information - Assessment Methods and Objects

Examine: System media protection policy

access authorization policy

procedures addressing downgrading of media containing classified information

procedures addressing handling of classified information

NSA standards and policies regarding protection of classified information

media downgrading records

system security plan

other relevant documents or records

Interview: Organizational personnel with system media downgrading responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for media downgrading

mechanisms supporting and/or implementing media downgrading
Assessing Security and Privacy Controls in Information Systems and Organizations
MP > MP-8 > MP-8(4) > Assessment Objective

MP-8(4) Classified Information - Assessment Objective
Determine if the following are satisfied:

MP-08(04)[01] system media containing classified information is identified;
MP-08(04)[02] system media containing classified information is downgraded prior to release to individuals without required access authorizations.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-1 > Assessment Methods

PE-1 Policy and Procedures - Assessment Methods and Objects

Examine: Physical and environmental protection policy and procedures

system security plan

privacy plan

organizational risk management strategy

other relevant documents or records

Interview: Organizational personnel with physical and environmental protection responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-1 > Assessment Objective

PE-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

PE-01a.[01] a physical and environmental protection policy is developed and documented;
PE-01a.[02] the physical and environmental protection policy is disseminated to [Assignment: organization-defined personnel or roles];
PE-01a.[03] physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented;
PE-01a.[04] the physical and environmental protection procedures are disseminated to [Assignment: organization-defined personnel or roles];
PE-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses purpose;
PE-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses scope;
PE-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses roles;
PE-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses responsibilities;
PE-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses management commitment;
PE-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses coordination among organizational entities;
PE-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses compliance;
PE-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
PE-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures;
PE-01c.01[01] the current physical and environmental protection policy is reviewed and updated [Assignment: organization-defined frequency];
PE-01c.01[02] the current physical and environmental protection policy is reviewed and updated following [Assignment: organization-defined events];
PE-01c.02[01] the current physical and environmental protection procedures are reviewed and updated [Assignment: organization-defined frequency];
PE-01c.02[02] the current physical and environmental protection procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > Assessment Methods

PE-2 Physical Access Authorizations - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access authorizations

authorized personnel access list

authorization credentials

physical access list reviews

physical access termination records and associated documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with physical access authorization responsibilities

organizational personnel with physical access to system facility

organizational personnel with information security responsibilities

Test: Organizational processes for physical access authorizations

mechanisms supporting and/or implementing physical access authorizations
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-2 > Assessment Objective

PE-2 Physical Access Authorizations - Assessment Objective
Determine if the following are satisfied:

PE-02a.[01] a list of individuals with authorized access to the facility where the system resides has been developed;
PE-02a.[02] the list of individuals with authorized access to the facility where the system resides has been approved;
PE-02a.[03] the list of individuals with authorized access to the facility where the system resides has been maintained;
PE-02b. authorization credentials are issued for facility access;
PE-02c. the access list detailing authorized facility access by individuals is reviewed [Assignment: organization-defined frequency];
PE-02d. individuals are removed from the facility access list when access is no longer required.