ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(3) > Assessment Methods

AC-4(3) Dynamic Information Flow Control - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system security architecture and associated documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(3) > Assessment Objective

AC-4(3) Dynamic Information Flow Control - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined information flow control policies] are enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(4) > Assessment Methods

AC-4(4) Flow Control of Encrypted Information - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(4) > Assessment Objective

AC-4(4) Flow Control of Encrypted Information - Assessment Objective
Determine if the following are satisfied:

encrypted information is prevented from bypassing [Assignment: organization-defined information flow control mechanisms] by [Selection; one or more: decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined organization-defined procedure or method] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(5) > Assessment Methods

AC-4(5) Embedded Data Types - Assessment Methods and Objects

Examine: Access control policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of limitations to be enforced on embedding data types within other data types

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(5) > Assessment Objective

AC-4(5) Embedded Data Types - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined limitations] are enforced on embedding data types within other data types.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(6) > Assessment Methods

AC-4(6) Metadata - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

types of metadata used to enforce information flow control decisions

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(6) > Assessment Objective

AC-4(6) Metadata - Assessment Objective
Determine if the following are satisfied:

information flow control enforcement is based on [Assignment: organization-defined metadata].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(7) > Assessment Methods

AC-4(7) One-way Flow Mechanisms - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system hardware mechanisms and associated configurations

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Hardware mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(7) > Assessment Objective

AC-4(7) One-way Flow Mechanisms - Assessment Objective
Determine if the following are satisfied:

one-way information flows are enforced through hardware-based flow control mechanisms.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(8) > Assessment Methods

AC-4(8) Security and Privacy Policy Filters - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of security policy filters regulating flow control decisions

list of privacy policy filters regulating flow control decisions

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy

security and privacy policy filters
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(8) > Assessment Objective

AC-4(8) Security and Privacy Policy Filters - Assessment Objective
Determine if the following are satisfied:

AC-04(08)(a)[01] information flow control is enforced using [Assignment: organization-defined security policy filter] as a basis for flow control decisions for [Assignment: organization-defined information flows];
AC-04(08)(a)[02] information flow control is enforced using [Assignment: organization-defined privacy policy filter] as a basis for flow control decisions for [Assignment: organization-defined information flows];
AC-04(08)(b) [Selection; one or more: block; strip; modify; quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined security policy];

[Selection; one or more: block; strip; modify; quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined privacy policy].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(9) > Assessment Methods

AC-4(9) Human Reviews - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

records of human reviews regarding information flows

list of information flows requiring the use of human reviews

list of conditions requiring human reviews for information flows

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

organizational personnel with information flow enforcement responsibilities

system developers

Test: Mechanisms enforcing the use of human reviews
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(9) > Assessment Objective

AC-4(9) Human Reviews - Assessment Objective
Determine if the following are satisfied:

human reviews are used for [Assignment: organization-defined information flows] under [Assignment: organization-defined conditions].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(10) > Assessment Methods

AC-4(10) Enable and Disable Security or Privacy Policy Filters - Assessment Methods and Objects

Examine: Access control policy

information flow information policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of security policy filters enabled/disabled by privileged administrators

list of privacy policy filters enabled/disabled by privileged administrators

list of approved data types for enabling/disabling by privileged administrators

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for enabling/disabling security and privacy policy filters

system/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy

security and privacy policy filters
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(10) > Assessment Objective

AC-4(10) Enable and Disable Security or Privacy Policy Filters - Assessment Objective
Determine if the following are satisfied:

AC-04(10)[01] capability is provided for privileged administrators to enable and disable [Assignment: organization-defined security filters] under [Assignment: organization-defined conditions];
AC-04(10)[02] capability is provided for privileged administrators to enable and disable [Assignment: organization-defined privacy filters] under [Assignment: organization-defined conditions].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(11) > Assessment Methods

AC-4(11) Configuration of Security or Privacy Policy Filters - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of security policy filters

list of privacy policy filters

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for configuring security and privacy policy filters

system/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy

security and privacy policy filters
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(11) > Assessment Objective

AC-4(11) Configuration of Security or Privacy Policy Filters - Assessment Objective
Determine if the following are satisfied:

AC-04(11)[01] capability is provided for privileged administrators to configure [Assignment: organization-defined security policy filters] to support different security or privacy policies;
AC-04(11)[02] capability is provided for privileged administrators to configure [Assignment: organization-defined privacy policy filters] to support different security or privacy policies.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(12) > Assessment Methods

AC-4(12) Data Type Identifiers - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of data type identifiers

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(12) > Assessment Objective

AC-4(12) Data Type Identifiers - Assessment Objective
Determine if the following are satisfied:

when transferring information between different security domains, [Assignment: organization-defined data type identifiers] are used to validate data essential for information flow decisions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(13) > Assessment Methods

AC-4(13) Decomposition into Policy-relevant Subcomponents - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(13) > Assessment Objective

AC-4(13) Decomposition into Policy-relevant Subcomponents - Assessment Objective
Determine if the following are satisfied:

when transferring information between different security domains, information is decomposed into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(14) > Assessment Methods

AC-4(14) Security or Privacy Policy Filter Constraints - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of security and privacy policy filters

list of data structure policy filters

list of data content policy filters

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy

security and privacy policy filters
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(14) > Assessment Objective

AC-4(14) Security or Privacy Policy Filter Constraints - Assessment Objective
Determine if the following are satisfied:

AC-04(14)[01] when transferring information between different security domains, implemented [Assignment: organization-defined security policy filters] require fully enumerated formats that restrict data structure and content;
AC-04(14)[02] when transferring information between different security domains, implemented [Assignment: organization-defined privacy policy filters] require fully enumerated formats that restrict data structure and content.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(15) > Assessment Methods

AC-4(15) Detection of Unsanctioned Information - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of unsanctioned information types and associated information

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

organizational personnel with privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(15) > Assessment Objective

AC-4(15) Detection of Unsanctioned Information - Assessment Objective
Determine if the following are satisfied:

AC-04(15)[01] when transferring information between different security domains, information is examined for the presence of [Assignment: organization-defined unsanctioned information];
AC-04(15)[02] when transferring information between different security domains, transfer of [Assignment: organization-defined unsanctioned information] is prohibited in accordance with the [Assignment: organization-defined security policy];
AC-04(15)[03] when transferring information between different security domains, transfer of [Assignment: organization-defined unsanctioned information] is prohibited in accordance with the [Assignment: organization-defined privacy policy].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(17) > Assessment Methods

AC-4(17) Domain Authentication - Assessment Methods and Objects

Examine: Access control policy

information flow control policies

procedures addressing information flow enforcement

procedures addressing source and destination domain identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of system labels

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement policy
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(17) > Assessment Objective

AC-4(17) Domain Authentication - Assessment Objective
Determine if the following are satisfied:

source and destination points are uniquely identified and authenticated by [Selection; one or more: organization, system, application, service, individual] for information transfer.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(19) > Assessment Methods

AC-4(19) Validation of Metadata - Assessment Methods and Objects

Examine: Information flow enforcement policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of security policy filtering criteria applied to metadata and data payloads

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

organizational personnel with privacy responsibilities

system developers

Test: Mechanisms implementing information flow enforcement functions

security and policy filters
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(19) > Assessment Objective

AC-4(19) Validation of Metadata - Assessment Objective
Determine if the following are satisfied:

AC-04(19)[01] when transferring information between different security domains, [Assignment: organization-defined security policy filters] are implemented on metadata;
AC-04(19)[02] when transferring information between different security domains, [Assignment: organization-defined privacy policy filters] are implemented on metadata.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(20) > Assessment Methods

AC-4(20) Approved Solutions - Assessment Methods and Objects

Examine: Information flow enforcement policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of solutions in approved configurations

approved configuration baselines

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(20) > Assessment Objective

AC-4(20) Approved Solutions - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined solutions in approved configurations] are employed to control the flow of [Assignment: organization-defined information] across security domains.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(21) > Assessment Methods

AC-4(21) Physical or Logical Separation of Information Flows - Assessment Methods and Objects

Examine: Information flow enforcement policy

information flow control policies

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

list of required separation of information flows by information types

list of mechanisms and/or techniques used to logically or physically separate information flows

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(21) > Assessment Objective

AC-4(21) Physical or Logical Separation of Information Flows - Assessment Objective
Determine if the following are satisfied:

AC-04(21)[01] information flows are separated logically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations];
AC-04(21)[02] information flows are separated physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(22) > Assessment Methods

AC-4(22) Access Only - Assessment Methods and Objects

Examine: Information flow enforcement policy

procedures addressing information flow enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information flow enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing information flow enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-4 > AC-4(22) > Assessment Objective

AC-4(22) Access Only - Assessment Objective
Determine if the following are satisfied:

access is provided from a single device to computing platforms, applications, or data that reside in multiple different security domains while preventing information flow between the different security domains.