ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(5) > Assessment Methods

IA-12(5) Address Confirmation - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identity proofing

system security plan

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(5) > Assessment Objective

IA-12(5) Address Confirmation - Assessment Objective
Determine if the following are satisfied:

a [Selection: registration code; notice of proofing] is delivered through an out-of-band channel to verify the user's address (physical or digital) of record.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(6) > Assessment Methods

IA-12(6) Accept Externally-proofed Identities - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identity proofing

system security plan

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(6) > Assessment Objective

IA-12(6) Accept Externally-proofed Identities - Assessment Objective
Determine if the following are satisfied:

externally proofed identities are accepted [Assignment: organization-defined identity assurance level].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > Assessment Methods

IA-13 Identity Providers and Authorization Servers - Assessment Methods and Objects

Examine: Identification and authentication policy;

procedures addressing user and device identification and authentication;

system security plan;

system design documentation;

system configuration settings and associated documentation;

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities;

organizational personnel with information security responsibilities;

system/network administrators;

organizational personnel with account management responsibilities;

system developers

Test: Mechanisms supporting and/or implementing identification and authentication capabilities and access rights
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > Assessment Objective

IA-13 Identity Providers and Authorization Servers - Assessment Objective
Determine if the following are satisfied:

IA-13[01] identity providers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authentication decisions in accordance with [Assignment: organization-defined mechanisms] using [Assignment: organization-defined mechanisms];
IA-13[02] identity providers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authorization decisions in accordance with [Assignment: organization-defined mechanisms] using [Assignment: organization-defined mechanisms];
IA-13[03] authorization servers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authentication decisions in accordance with [Assignment: organization-defined mechanisms] using [Assignment: organization-defined mechanisms];
IA-13[04] authorization servers are employed to manage user, device, and non-person entity (NPE) identities, attributes and access rights supporting authorization decisions in accordance with [Assignment: organization-defined mechanisms] using [Assignment: organization-defined mechanisms];
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > IA-13(1) > Assessment Methods

IA-13(1) Protection of Cryptographic Keys - Assessment Methods and Objects

Examine: Identification and authentication policy;

procedures addressing cryptographic key establishment and management;

system design documentation;

cryptographic mechanisms;

system configuration settings and associated documentation;

system security plan;

other relevant documents or records

Interview: System/network administrators;

organizational personnel with information security responsibilities;

organizational personnel with responsibilities for cryptographic key establishment and/or management

Test: Organizational processes for cryptographic key management;

cryptographic modules generating, storing, and using cryptographic keys
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > IA-13(1) > Assessment Objective

IA-13(1) Protection of Cryptographic Keys - Assessment Objective
Determine if the following are satisfied:

IA-13(01)[01] cryptographic keys that protect access tokens are generated;
IA-13(01)[02] cryptographic keys that protect access tokens are managed;
IA-13(01)[03] cryptographic keys that protect access tokens are protected from disclosure; and
IA-13(01)[04] cryptographic keys that protect access tokens are protected from disclosure and misuse
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > IA-13(2) > Assessment Methods

IA-13(2) Verification of Identity Assertions and Access Tokens - Assessment Methods and Objects

Examine: Identification and authentication policy;

system security plan; system design documentation;

system configuration settings and associated documentation;

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities;

organizational personnel with information security responsibilities;

system/ network administrators;

organizational personnel with account management responsibilities;

system developers

Test: Identity provider mechanisms supporting and/or implementing identification and authentication capabilities and access rights
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > IA-13(2) > Assessment Objective

IA-13(2) Verification of Identity Assertions and Access Tokens - Assessment Objective
Determine if the following are satisfied:

IA-13(02)[01] the source of identity assertions is verified before granting access to system and information resources;
IA-13(02)[02] the source of access tokens is verified before granting access to system and information resources;
IA-13(02)[03] the integrity of identity assertions is verified before granting access to system and information resources;
IA-13(02)[04] the integrity of access tokens is verified before granting access to system and information resources
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > IA-13(3) > Assessment Methods

IA-13(3) Token Management - Assessment Methods and Objects

Examine: Identification and authentication policy;

access control policy;

procedures for assertion and token management;

system design documentation;

system configuration settings and associated documentation;

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities;

organizational personnel with information security responsibilities;

system/ network administrators;

organizational personnel with account management responsibilities;

system developers

Test: Mechanisms and software supporting and/or implementing token generation
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-13 > IA-13(3) > Assessment Objective

IA-13(3) Token Management - Assessment Objective
Determine if the following are satisfied:

IA-13(03)(a)[01] assertions are generated in accordance with [Assignment: organization-defined policy];
IA-13(03)(a)[02] access tokens are generated in accordance with [Assignment: organization-defined policy];
IA-13(03)(b)[01] assertions are issued in accordance with [Assignment: organization-defined policy];
IA-13(03)(b)[02] access tokens are issued in accordance with [Assignment: organization-defined policy];
IA-13(03)(c)[01] assertions are refreshed in accordance with [Assignment: organization-defined policy];
IA-13(03)(c)[02] access tokens are refreshed in accordance with [Assignment: organization-defined policy];
IA-13(03)(d)[01] assertions are revoked in accordance with [Assignment: organization-defined policy];
IA-13(03)(d)[02] access tokens are revoked in accordance with [Assignment: organization-defined policy];
IA-13(03)(e)[01] assertions are time-restricted in accordance with [Assignment: organization-defined policy];
IA-13(03)(e)[02] access tokens are time-restricted in accordance with [Assignment: organization-defined policy];
IA-13(03)(f)[01] assertions are audience-restricted in accordance with [Assignment: organization-defined policy];
IA-13(03)(f)[02] access tokens are audience-restricted in accordance with [Assignment: organization-defined policy];
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-1 > Assessment Methods

IR-1 Policy and Procedures - Assessment Methods and Objects

Examine: Incident response policy and procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-1 > Assessment Objective

IR-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

IR-01a.[01] an incident response policy is developed and documented;
IR-01a.[02] the incident response policy is disseminated to [Assignment: organization-defined personnel or roles];
IR-01a.[03] incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented;
IR-01a.[04] the incident response procedures are disseminated to [Assignment: organization-defined personnel or roles];
IR-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy addresses purpose;
IR-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy addresses scope;
IR-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy addresses roles;
IR-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy addresses responsibilities;
IR-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy addresses management commitment;
IR-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy addresses coordination among organizational entities;
IR-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy addresses compliance;
IR-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
IR-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures;
IR-01c.01[01] the current incident response policy is reviewed and updated [Assignment: organization-defined frequency];
IR-01c.01[02] the current incident response policy is reviewed and updated following [Assignment: organization-defined events];
IR-01c.02[01] the current incident response procedures are reviewed and updated [Assignment: organization-defined frequency];
IR-01c.02[02] the current incident response procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > Assessment Methods

IR-2 Incident Response Training - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response training

incident response training curriculum

incident response training materials

privacy plan

incident response plan

incident response training records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response training and operational responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > Assessment Objective

IR-2 Incident Response Training - Assessment Objective
Determine if the following are satisfied:

IR-02a.01 incident response training is provided to system users consistent with assigned roles and responsibilities within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access;
IR-02a.02 incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
IR-02a.03 incident response training is provided to system users consistent with assigned roles and responsibilities [Assignment: organization-defined frequency] thereafter;
IR-02b.[01] incident response training content is reviewed and updated [Assignment: organization-defined frequency];
IR-02b.[02] incident response training content is reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > IR-2(1) > Assessment Methods

IR-2(1) Simulated Events - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response training

incident response training curriculum

incident response training materials

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response training and operational responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms that support and/or implement simulated events for incident response training
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > IR-2(1) > Assessment Objective

IR-2(1) Simulated Events - Assessment Objective
Determine if the following are satisfied:

simulated events are incorporated into incident response training to facilitate the required response by personnel in crisis situations.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > IR-2(2) > Assessment Methods

IR-2(2) Automated Training Environments - Assessment Methods and Objects

Examine: Incident response policy

procedures addressing incident response training

incident response training curriculum

incident response training materials

automated mechanisms supporting incident response training

incident response plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response training and operational responsibilities

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms that provide a thorough and realistic incident response training environment
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > IR-2(2) > Assessment Objective

IR-2(2) Automated Training Environments - Assessment Objective
Determine if the following are satisfied:

an incident response training environment is provided using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > IR-2(3) > Assessment Methods

IR-2(3) Breach - Assessment Methods and Objects

Examine: Incident response policy

contingency planning policy

procedures addressing incident response testing

procedures addressing contingency plan testing

incident response testing material

incident response test results

incident response test plan

incident response plan

contingency plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response training responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-2 > IR-2(3) > Assessment Objective

IR-2(3) Breach - Assessment Objective
Determine if the following are satisfied:

IR-02(03)[01] incident response training on how to identify and respond to a breach is provided;
IR-02(03)[02] incident response training on the organization's process for reporting a breach is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > Assessment Methods

IR-3 Incident Response Testing - Assessment Methods and Objects

Examine: Incident response policy

contingency planning policy

procedures addressing incident response testing

procedures addressing contingency plan testing

incident response testing material

incident response test results

incident response test plan

incident response plan

contingency plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response testing responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > Assessment Objective

IR-3 Incident Response Testing - Assessment Objective
Determine if the following are satisfied:

the effectiveness of the incident response capability for the system is tested [Assignment: organization-defined frequency] using [Assignment: organization-defined tests].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > IR-3(1) > Assessment Methods

IR-3(1) Automated Testing - Assessment Methods and Objects

Examine: Incident response policy

contingency planning policy

procedures addressing incident response testing

procedures addressing contingency plan testing

incident response testing documentation

incident response test results

incident response test plan

incident response plan

contingency plan

system security plan

automated mechanisms supporting incident response tests

other relevant documents or records

Interview: Organizational personnel with incident response testing responsibilities

organizational personnel with information security responsibilities

Test: Automated mechanisms that more thoroughly and effectively test the incident response capability
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > IR-3(1) > Assessment Objective

IR-3(1) Automated Testing - Assessment Objective
Determine if the following are satisfied:

the incident response capability is tested using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > IR-3(2) > Assessment Methods

IR-3(2) Coordination with Related Plans - Assessment Methods and Objects

Examine: Incident response policy

contingency planning policy

procedures addressing incident response testing

incident response testing documentation

incident response plan

business continuity plans

contingency plans

disaster recovery plans

continuity of operations plans

crisis communications plans

critical infrastructure plans

occupant emergency plans

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response testing responsibilities

organizational personnel with responsibilities for testing organizational plans related to incident response testing

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > IR-3(2) > Assessment Objective

IR-3(2) Coordination with Related Plans - Assessment Objective
Determine if the following are satisfied:

incident response testing is coordinated with organizational elements responsible for related plans.
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > IR-3(3) > Assessment Methods

IR-3(3) Continuous Improvement - Assessment Methods and Objects

Examine: Incident response policy

contingency planning policy

procedures addressing incident response testing

incident response testing documentation

incident response plan

business continuity plans

contingency plans

disaster recovery plans

continuity of operations plans

crisis communications plans

critical infrastructure plans

occupant emergency plans

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with incident response testing responsibilities

organizational personnel with responsibilities for testing organizational plans related to incident response testing

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IR > IR-3 > IR-3(3) > Assessment Objective

IR-3(3) Continuous Improvement - Assessment Objective
Determine if the following are satisfied:

IR-03(03)(a)[01] qualitative data from testing are used to determine the effectiveness of incident response processes;
IR-03(03)(a)[02] quantitative data from testing are used to determine the effectiveness of incident response processes;
IR-03(03)(b)[01] qualitative data from testing are used to continuously improve incident response processes;
IR-03(03)(b)[02] quantitative data from testing are used to continuously improve incident response processes;
IR-03(03)(c)[01] qualitative data from testing are used to provide incident response measures and metrics that are accurate;
IR-03(03)(c)[02] quantitative data from testing are used to provide incident response measures and metrics that are accurate;
IR-03(03)(c)[03] qualitative data from testing are used to provide incident response measures and metrics that are consistent;
IR-03(03)(c)[04] quantitative data from testing are used to provide incident response measures and metrics that are consistent;
IR-03(03)(c)[05] qualitative data from testing are used to provide incident response measures and metrics in a reproducible format;
IR-03(03)(c)[06] quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.