ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > Assessment Objective

SA-3 System Development Life Cycle - Assessment Objective
Determine if the following are satisfied:

SA-03a.[01] the system is acquired, developed, and managed using [Assignment: organization-defined system-development life cycle] that incorporates information security considerations;
SA-03a.[02] the system is acquired, developed, and managed using [Assignment: organization-defined system-development life cycle] that incorporates privacy considerations;
SA-03b.[01] information security roles and responsibilities are defined and documented throughout the system development life cycle;
SA-03b.[02] privacy roles and responsibilities are defined and documented throughout the system development life cycle;
SA-03c.[01] individuals with information security roles and responsibilities are identified;
SA-03c.[02] individuals with privacy roles and responsibilities are identified;
SA-03d.[01] organizational information security risk management processes are integrated into system development life cycle activities;
SA-03d.[02] organizational privacy risk management processes are integrated into system development life cycle activities.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > SA-3(1) > Assessment Methods

SA-3(1) Manage Preproduction Environment - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the integration of security and supply chain risk management into the system development life cycle process

system development life cycle documentation

procedures addressing program protection planning

criticality analysis results

security and supply chain risk management strategy/program documentation

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with security and system life cycle development responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for defining and documenting the system development life cycle

organizational processes for identifying system development life cycle roles and responsibilities

organizational process for integrating security risk management into the system development life cycle

mechanisms supporting and/or implementing the system development life cycle
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > SA-3(1) > Assessment Objective

SA-3(1) Manage Preproduction Environment - Assessment Objective
Determine if the following are satisfied:

system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component, or system service.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > SA-3(2) > Assessment Methods

SA-3(2) Use of Live or Operational Data - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of security and privacy into the system development life cycle process

system development life cycle documentation

security risk assessment documentation

privacy impact assessment

privacy risk assessment documentation

system security plan

privacy plan

data mapping documentation

personally identifiable information processing policy

procedures addressing the authority to test with personally identifiable information

procedures addressing the minimization of personally identifiable information used in testing, training, and research

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibility

organizational personnel with system life cycle development responsibilities

Test: Organizational processes the use of live data in pre-production environments

mechanisms for protecting live data in pre-production environments
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > SA-3(2) > Assessment Objective

SA-3(2) Use of Live or Operational Data - Assessment Objective
Determine if the following are satisfied:

SA-03(02)a.[01] the use of live data in pre-production environments is approved for the system, system component, or system service;
SA-03(02)a.[02] the use of live data in pre-production environments is documented for the system, system component, or system service;
SA-03(02)a.[03] the use of live data in pre-production environments is controlled for the system, system component, or system service;
SA-03(02)b. pre-production environments for the system, system component, or system service are protected at the same impact or classification level as any live data in use within the pre-production environments.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > SA-3(3) > Assessment Methods

SA-3(3) Technology Refresh - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing technology refresh planning and implementation

system development life cycle documentation

technology refresh schedule

security risk assessment documentation

privacy impact assessment

privacy risk assessment documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

organizational personnel with system life cycle development responsibilities

Test: Organizational processes for defining and documenting the system development life cycle

organizational processes for identifying system development life cycle roles and responsibilities

organizational processes for integrating security and privacy risk management into the system development life cycle

mechanisms supporting and/or implementing the system development life cycle
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-3 > SA-3(3) > Assessment Objective

SA-3(3) Technology Refresh - Assessment Objective
Determine if the following are satisfied:

SA-03(03)[01] a technology refresh schedule is planned for the system throughout the system development life cycle;
SA-03(03)[02] a technology refresh schedule is implemented for the system throughout the system development life cycle.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > Assessment Methods

SA-4 Acquisition Process - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process

configuration management plan

acquisition contracts for the system, system component, or system service

system design documentation

system security plan

supply chain risk management plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for determining system security and privacy functional, strength, and assurance requirements

organizational processes for developing acquisition contracts

mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(1) > Assessment Methods

SA-4(1) Functional Properties of Controls - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system services

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with information security and privacy responsibilities

system developers

Test: Organizational processes for determining system security functional requirements

organizational processes for developing acquisition contracts

mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(1) > Assessment Objective

SA-4(1) Functional Properties of Controls - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(2) > Assessment Methods

SA-4(2) Design and Implementation Information for Controls - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system components, or system services

design and implementation information for controls employed in the system, system component, or system service

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility to determine system security requirements

system developers or service provider

organizational personnel with information security responsibilities

Test: Organizational processes for determining the level of detail for system design and controls

organizational processes for developing acquisition contracts

mechanisms supporting and/or implementing the development of system design details
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(2) > Assessment Objective

SA-4(2) Design and Implementation Information for Controls - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [Selection; one or more: security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: organization-defined design and implementation information] ] at [Assignment: organization-defined level of detail].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(3) > Assessment Methods

SA-4(3) Development Methods, Techniques, and Practices - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system service

list of systems security and privacy engineering methods to be included in the developer's system development life cycle process

list of software development methods to be included in the developer's system development life cycle process

list of testing, evaluation, or validation techniques to be included in the developer's system development life cycle process

list of quality control processes to be included in the developer's system development life cycle process

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with system life cycle responsibilities

system developers or service provider

Test: Organizational processes for development methods, techniques, and processes
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(3) > Assessment Objective

SA-4(3) Development Methods, Techniques, and Practices - Assessment Objective
Determine if the following are satisfied:

SA-04(03)(a) the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Assignment: organization-defined systems engineering methods];
SA-04(03)(b) the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection; one or more: [Assignment: organization-defined system security engineering methods] ; [Assignment: organization-defined privacy engineering methods] ];
SA-04(03)(c) the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [Selection; one or more: [Assignment: organization-defined software development methods] ; [Assignment: organization-defined testing, evaluation, assessment, verification, and validation methods] ; [Assignment: organization-defined quality control processes] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(5) > Assessment Methods

SA-4(5) System, Component, and Service Configurations - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system service

security configurations to be implemented by the developer of the system, system component, or system service

service level agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility to determine system security requirements

system developers or service provider

organizational personnel with information security responsibilities

Test: Mechanisms used to verify that the configuration of the system, component, or service is delivered as specified
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(5) > Assessment Objective

SA-4(5) System, Component, and Service Configurations - Assessment Objective
Determine if the following are satisfied:

SA-04(05)(a) the developer of the system, system component, or system service is required to deliver the system, component, or service with [Assignment: organization-defined security configurations] implemented;
SA-04(05)(b) the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(6) > Assessment Methods

SA-4(6) Use of Information Assurance Products - Assessment Methods and Objects

Examine: Supply chain risk management plan

system and services acquisition policy

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system service

security configurations to be implemented by the developer of the system, system component, or system service

service level agreements

list of deployed IT products/solutions

NSA-approved list

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility to determine system security requirements

organizational personnel responsible for ensuring information assurance products are NSA-approved and are evaluated and/or validated products in accordance with NSA-approved procedures

organizational personnel with information security responsibilities

Test: Organizational processes for selecting and employing evaluated and/or validated information assurance products and services that compose an NSA-approved solution to protect classified information
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(6) > Assessment Objective

SA-4(6) Use of Information Assurance Products - Assessment Objective
Determine if the following are satisfied:

SA-04(06)(a) only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted are employed;
SA-04(06)(b) these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(7) > Assessment Methods

SA-4(7) NIAP-approved Protection Profiles - Assessment Methods and Objects

Examine: Supply chain risk management plan

system and services acquisition policy

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

solicitation documents

acquisition documentation

acquisition contracts for the system, system component, or system service

list of deployed IT products/solutions

NAIP-approved protection profiles

FIPS-validation information for cryptographic functionality

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility for determining system security requirements

organizational personnel responsible for ensuring that information assurance products have been evaluated against a NIAP-approved protection profile or for ensuring products relying on cryptographic functionality are FIPS-validated

organizational personnel with information security responsibilities

Test: Organizational processes for selecting and employing products/services evaluated against a NIAP-approved protection profile or FIPS-validated products
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(7) > Assessment Objective

SA-4(7) NIAP-approved Protection Profiles - Assessment Objective
Determine if the following are satisfied:

SA-04(07)(a) the use of commercially provided information assurance and information assurance-enabled information technology products is limited to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists;
SA-04(07)(b) if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that cryptographic module is required to be FIPS-validated or NSA-approved.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(8) > Assessment Methods

SA-4(8) Continuous Monitoring Plan for Controls - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing developer continuous monitoring plans

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

developer continuous monitoring plans

security assessment plans

acquisition contracts for the system, system component, or system service

acquisition documentation

solicitation documentation

service level agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility for determining system security requirements

system developers

organizational personnel with information security responsibilities

Test: Vendor processes for continuous monitoring

mechanisms supporting and/or implementing developer continuous monitoring
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(8) > Assessment Objective

SA-4(8) Continuous Monitoring Plan for Controls - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(9) > Assessment Methods

SA-4(9) Functions, Ports, Protocols, and Services in Use - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process

system design documentation

system documentation, including functions, ports, protocols, and services intended for organizational use

acquisition contracts for systems or services

acquisition documentation

solicitation documentation

service level agreements

organizational security requirements, descriptions, and criteria for developers of systems, system components, and system services

system security plan

other relevant documents or records

Interview: Organizational personnel with acquisition/contracting responsibilities

organizational personnel with the responsibility for determining system security requirements

system/network administrators

organizational personnel operating, using, and/or maintaining the system

system developers

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-4 > SA-4(9) > Assessment Objective

SA-4(9) Functions, Ports, Protocols, and Services in Use - Assessment Objective
Determine if the following are satisfied:

SA-04(09)[01] the developer of the system, system component, or system service is required to identify the functions intended for organizational use;
SA-04(09)[02] the developer of the system, system component, or system service is required to identify the ports intended for organizational use;
SA-04(09)[03] the developer of the system, system component, or system service is required to identify the protocols intended for organizational use;
SA-04(09)[04] the developer of the system, system component, or system service is required to identify the services intended for organizational use.