ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(7) > Discussion

SI-2(7) Root Cause Analysis - Discussion
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

Root cause analysis includes a wide range of approaches, tools, and techniques to systematically identify the underlying cause of issues or failures to systems and systems components (hardware, software, and firmware). Organizations consider the severity of the incident to determine what root cause analysis method is used and how quickly implementation of the remediation actions. The root cause analysis includes a timeline, missed warning signs, key decisions, gaps, mitigations, and verification of effectiveness. The actions identified to address the source of the issue are implemented and integrated into applicable organizational policy, procedures, and control implementation.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-2 > SI-2(7)

SI-2(7) Flaw Remediation | Root Cause Analysis
Family: System and Information Integrity (SI) > SI-2 Flaw Remediation

a. Conduct root cause analysis to identify underlying causes of issues or failures.
b. Develop actions to address the root cause of the issue or failure.
c. Implement the actions and monitor the implementation for effectiveness.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3

SI-3 Malicious Code Protection
Family: System and Information Integrity (SI)

a. Implement [Selection; one or more: signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
c. Configure malicious code protection mechanisms to:
1. Perform periodic scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection; one or more: endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and
2. [Selection; one or more: block malicious code; quarantine malicious code; take [Assignment: organization-defined action] ] ; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection; and
d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > Discussion

SI-3 Malicious Code Protection - Discussion
Family: System and Information Integrity (SI)

System entry and exit points include firewalls, remote access servers, workstations, electronic mail servers, web servers, proxy servers, notebook computers, and mobile devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can also be encoded in various formats contained within compressed or hidden files or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways, including by electronic mail, the world-wide web, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities. A variety of technologies and methods exist to limit or eliminate the effects of malicious code.

Malicious code protection mechanisms include both signature- and nonsignature-based technologies. Nonsignature-based detection mechanisms include artificial intelligence techniques that use heuristics to detect, analyze, and describe the characteristics or behavior of malicious code and to provide controls against such code for which signatures do not yet exist or for which existing signatures may not be effective. Malicious code for which active signatures do not yet exist or may be ineffective includes polymorphic malicious code (i.e., code that changes signatures when it replicates). Nonsignature-based mechanisms also include reputation-based technologies. In addition to the above technologies, pervasive configuration management, comprehensive software integrity controls, and anti-exploitation software may be effective in preventing the execution of unauthorized code. Malicious code may be present in commercial off-the-shelf software as well as custom-built software and could include logic bombs, backdoors, and other types of attacks that could affect organizational mission and business functions.

In situations where malicious code cannot be detected by detection methods or technologies, organizations rely on other types of controls, including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to ensure that software does not perform functions other than the functions intended. Organizations may determine that, in response to the detection of malicious code, different actions may be warranted. For example, organizations can define actions in response to malicious code detection during periodic scans, the detection of malicious downloads, or the detection of maliciousness when attempting to open or execute files.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > SI-3(4) > Discussion

SI-3(4) Updates Only by Privileged Users - Discussion
Family: System and Information Integrity (SI) > SI-3 Malicious Code Protection

Protection mechanisms for malicious code are typically categorized as security-related software and, as such, are only updated by organizational personnel with appropriate access privileges.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > SI-3(4)

SI-3(4) Malicious Code Protection | Updates Only by Privileged Users
Family: System and Information Integrity (SI) > SI-3 Malicious Code Protection

Update malicious code protection mechanisms only when directed by a privileged user.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > SI-3(6)

SI-3(6) Malicious Code Protection | Testing and Verification
Family: System and Information Integrity (SI) > SI-3 Malicious Code Protection

(a) Test malicious code protection mechanisms [Assignment: organization-defined frequency] by introducing known benign code into the system; and
(b) Verify that the detection of the code and the associated incident reporting occur.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > SI-3(8) > Discussion

SI-3(8) Detect Unauthorized Commands - Discussion
Family: System and Information Integrity (SI) > SI-3 Malicious Code Protection

Detecting unauthorized commands can be applied to critical interfaces other than kernel-based interfaces, including interfaces with virtual machines and privileged applications. Unauthorized operating system commands include commands for kernel functions from system processes that are not trusted to initiate such commands as well as commands for kernel functions that are suspicious even though commands of that type are reasonable for processes to initiate. Organizations can define the malicious commands to be detected by a combination of command types, command classes, or specific instances of commands. Organizations can also define hardware components by component type, component, component location in the network, or a combination thereof. Organizations may select different actions for different types, classes, or instances of malicious commands.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > SI-3(8)

SI-3(8) Malicious Code Protection | Detect Unauthorized Commands
Family: System and Information Integrity (SI) > SI-3 Malicious Code Protection

(a) Detect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: organization-defined system hardware components]: [Assignment: organization-defined unauthorized operating system commands] ; and
(b) [Selection; one or more: issue a warning; audit the command execution; prevent the execution of the command].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > SI-3(10) > Discussion

SI-3(10) Malicious Code Analysis - Discussion
Family: System and Information Integrity (SI) > SI-3 Malicious Code Protection

The use of malicious code analysis tools provides organizations with a more in-depth understanding of adversary tradecraft (i.e., tactics, techniques, and procedures) and the functionality and purpose of specific instances of malicious code. Understanding the characteristics of malicious code facilitates effective organizational responses to current and future threats. Organizations can conduct malicious code analyses by employing reverse engineering techniques or by monitoring the behavior of executing code.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-3 > SI-3(10)

SI-3(10) Malicious Code Protection | Malicious Code Analysis
Family: System and Information Integrity (SI) > SI-3 Malicious Code Protection

(a) Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: [Assignment: organization-defined tools and techniques] ; and
(b) Incorporate the results from malicious code analysis into organizational incident response and flaw remediation processes.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4

SI-4 System Monitoring
Family: System and Information Integrity (SI)

a. Monitor the system to detect:
1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives] ; and
2. Unauthorized local, network, and remote connections;
b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];
c. Invoke internal monitoring capabilities or deploy monitoring devices:
1. Strategically within the system to collect organization-determined essential information; and
2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
d. Analyze detected events and anomalies;
e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
f. Obtain legal opinion regarding system monitoring activities; and
g. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection; one or more: as needed; [Assignment: organization-defined frequency] ].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > Discussion

SI-4 System Monitoring - Discussion
Family: System and Information Integrity (SI)

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software.

Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls [SC-7](#sc-7) and [AC-17](#ac-17) . The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-17(1)](#ac-17.1), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) ). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(1) > Discussion

SI-4(1) System-wide Intrusion Detection System - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Linking individual intrusion detection tools into a system-wide intrusion detection system provides additional coverage and effective detection capabilities. The information contained in one intrusion detection tool can be shared widely across the organization, making the system-wide detection capability more robust and powerful.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(1)

SI-4(1) System Monitoring | System-wide Intrusion Detection System
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(2) > Discussion

SI-4(2) Automated Tools and Mechanisms for Real-time Analysis - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Automated tools and mechanisms include host-based, network-based, transport-based, or storage-based event monitoring tools and mechanisms or security information and event management (SIEM) technologies that provide real-time analysis of alerts and notifications generated by organizational systems. Automated monitoring techniques can create unintended privacy risks because automated controls may connect to external or otherwise unrelated systems. The matching of records between these systems may create linkages with unintended consequences. Organizations assess and document these risks in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(2)

SI-4(2) System Monitoring | Automated Tools and Mechanisms for Real-time Analysis
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Employ automated tools and mechanisms to support near real-time analysis of events.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(3) > Discussion

SI-4(3) Automated Tool and Mechanism Integration - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Using automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access and flow control mechanisms facilitates a rapid response to attacks by enabling the reconfiguration of mechanisms in support of attack isolation and elimination.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(3)

SI-4(3) System Monitoring | Automated Tool and Mechanism Integration
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(4) > Discussion

SI-4(4) Inbound and Outbound Communications Traffic - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Unusual or unauthorized activities or conditions related to system inbound and outbound communications traffic includes internal traffic that indicates the presence of malicious code or unauthorized use of legitimate code or credentials within organizational systems or propagating among system components, signaling to external systems, and the unauthorized exporting of information. Evidence of malicious code or unauthorized use of legitimate code or credentials is used to identify potentially compromised systems or system components.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(4)

SI-4(4) System Monitoring | Inbound and Outbound Communications Traffic
Family: System and Information Integrity (SI) > SI-4 System Monitoring

(a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;
(b) Monitor inbound and outbound communications traffic [Assignment: organization-defined organization-defined frequency] for [Assignment: organization-defined organization-defined unusual or unauthorized activities or conditions].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(5) > Discussion

SI-4(5) System-generated Alerts - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Alerts may be generated from a variety of sources, including audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be automated and may be transmitted telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the alert notification list can include system administrators, mission or business owners, system owners, information owners/stewards, senior agency information security officers, senior agency officials for privacy, system security officers, or privacy officers. In contrast to alerts generated by the system, alerts generated by organizations in [SI-4(12)](#si-4.12) focus on information sources external to the system, such as suspicious activity reports and reports on potential insider threats.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(5)

SI-4(5) System Monitoring | System-generated Alerts
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(7) > Discussion

SI-4(7) Automated Response to Suspicious Events - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Least-disruptive actions include initiating requests for human responses.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(7)

SI-4(7) System Monitoring | Automated Response to Suspicious Events
Family: System and Information Integrity (SI) > SI-4 System Monitoring

(a) Notify [Assignment: organization-defined incident response personnel] of detected suspicious events; and
(b) Take the following actions upon detection: [Assignment: organization-defined least-disruptive actions].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(9) > Discussion

SI-4(9) Testing of Monitoring Tools and Mechanisms - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Testing intrusion-monitoring tools and mechanisms is necessary to ensure that the tools and mechanisms are operating correctly and continue to satisfy the monitoring objectives of organizations. The frequency and depth of testing depends on the types of tools and mechanisms used by organizations and the methods of deployment.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(9)

SI-4(9) System Monitoring | Testing of Monitoring Tools and Mechanisms
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Test intrusion-monitoring tools and mechanisms [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(10) > Discussion

SI-4(10) Visibility of Encrypted Communications - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Organizations balance the need to encrypt communications traffic to protect data confidentiality with the need to maintain visibility into such traffic from a monitoring perspective. Organizations determine whether the visibility requirement applies to internal encrypted traffic, encrypted traffic intended for external destinations, or a subset of the traffic types.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(10)

SI-4(10) System Monitoring | Visibility of Encrypted Communications
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(11) > Discussion

SI-4(11) Analyze Communications Traffic Anomalies - Discussion
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Organization-defined interior points include subnetworks and subsystems. Anomalies within organizational systems include large file transfers, long-time persistent connections, attempts to access information from unexpected locations, the use of unusual protocols and ports, the use of unmonitored network protocols (e.g., IPv6 usage during IPv4 transition), and attempted communications with suspected malicious external addresses.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-4 > SI-4(11)

SI-4(11) System Monitoring | Analyze Communications Traffic Anomalies
Family: System and Information Integrity (SI) > SI-4 System Monitoring

Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: organization-defined interior points] to discover anomalies.