ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SA > SA-8 > SA-8(30)

SA-8(30) Security and Privacy Engineering Principles | Procedural Rigor
Family: System and Services Acquisition (SA) > SA-8 Security and Privacy Engineering Principles

Implement the security design principle of procedural rigor in [Assignment: organization-defined systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-8 > SA-8(31) > Discussion

SA-8(31) Secure System Modification - Discussion
Family: System and Services Acquisition (SA) > SA-8 Security and Privacy Engineering Principles

The principle of secure system modification states that system modification maintains system security with respect to the security requirements and risk tolerance of stakeholders. Upgrades or modifications to systems can transform secure systems into systems that are not secure. The procedures for system modification ensure that if the system is to maintain its trustworthiness, the same rigor that was applied to its initial development is applied to any system changes. Because modifications can affect the ability of the system to maintain its secure state, a careful security analysis of the modification is needed prior to its implementation and deployment. This principle parallels the principle of secure evolvability.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-8 > SA-8(31)

SA-8(31) Security and Privacy Engineering Principles | Secure System Modification
Family: System and Services Acquisition (SA) > SA-8 Security and Privacy Engineering Principles

Implement the security design principle of secure system modification in [Assignment: organization-defined systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-8 > SA-8(32) > Discussion

SA-8(32) Sufficient Documentation - Discussion
Family: System and Services Acquisition (SA) > SA-8 Security and Privacy Engineering Principles

The principle of sufficient documentation states that organizational personnel with responsibilities to interact with the system are provided with adequate documentation and other information such that the personnel contribute to rather than detract from system security. Despite attempts to comply with principles such as human factored security and acceptable security, systems are inherently complex, and the design intent for the use of security mechanisms and the ramifications of the misuse or misconfiguration of security mechanisms are not always intuitively obvious. Uninformed and insufficiently trained users can introduce vulnerabilities due to errors of omission and commission. The availability of documentation and training can help to ensure a knowledgeable cadre of personnel, all of whom have a critical role in the achievement of principles such as continuous protection. Documentation is written clearly and supported by training that provides security awareness and understanding of security-relevant responsibilities.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-8 > SA-8(32)

SA-8(32) Security and Privacy Engineering Principles | Sufficient Documentation
Family: System and Services Acquisition (SA) > SA-8 Security and Privacy Engineering Principles

Implement the security design principle of sufficient documentation in [Assignment: organization-defined systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-8 > SA-8(33) > Discussion

SA-8(33) Minimization - Discussion
Family: System and Services Acquisition (SA) > SA-8 Security and Privacy Engineering Principles

The principle of minimization states that organizations should only process personally identifiable information that is directly relevant and necessary to accomplish an authorized purpose and should only maintain personally identifiable information for as long as is necessary to accomplish the purpose. Organizations have processes in place, consistent with applicable laws and policies, to implement the principle of minimization.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-8 > SA-8(33)

SA-8(33) Security and Privacy Engineering Principles | Minimization
Family: System and Services Acquisition (SA) > SA-8 Security and Privacy Engineering Principles

Implement the privacy principle of minimization using [Assignment: organization-defined processes].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9

SA-9 External System Services
Family: System and Services Acquisition (SA)

a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls];
b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > Discussion

SA-9 External System Services - Discussion
Family: System and Services Acquisition (SA)

External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(1) > Discussion

SA-9(1) Risk Assessments and Organizational Approvals - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

Information security services include the operation of security devices, such as firewalls or key management services as well as incident monitoring, analysis, and response. Risks assessed can include system, mission or business, security, privacy, or supply chain risks.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(1)

SA-9(1) External System Services | Risk Assessments and Organizational Approvals
Family: System and Services Acquisition (SA) > SA-9 External System Services

(a) Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and
(b) Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: organization-defined personnel or roles].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(2) > Discussion

SA-9(2) Identification of Functions, Ports, Protocols, and Services - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be useful when the need arises to understand the trade-offs involved in restricting certain functions and services or blocking certain ports and protocols.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(2)

SA-9(2) External System Services | Identification of Functions, Ports, Protocols, and Services
Family: System and Services Acquisition (SA) > SA-9 External System Services

Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignment: organization-defined external system services].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(3) > Discussion

SA-9(3) Establish and Maintain Trust Relationship with Providers - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

Trust relationships between organizations and external service providers reflect the degree of confidence that the risk from using external services is at an acceptable level. Trust relationships can help organizations gain increased levels of confidence that service providers are providing adequate protection for the services rendered and can also be useful when conducting incident response or when planning for upgrades or obsolescence. Trust relationships can be complicated due to the potentially large number of entities participating in the consumer-provider interactions, subordinate relationships and levels of trust, and types of interactions between the parties. In some cases, the degree of trust is based on the level of control that organizations can exert on external service providers regarding the controls necessary for the protection of the service, information, or individual privacy and the evidence brought forth as to the effectiveness of the implemented controls. The level of control is established by the terms and conditions of the contracts or service-level agreements.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(3)

SA-9(3) External System Services | Establish and Maintain Trust Relationship with Providers
Family: System and Services Acquisition (SA) > SA-9 External System Services

Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: [Assignment: organization-defined organization-defined security and privacy requirements, properties, factors, or conditions defining acceptable trust relationships].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(4) > Discussion

SA-9(4) Consistent Interests of Consumers and Providers - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

As organizations increasingly use external service providers, it is possible that the interests of the service providers may diverge from organizational interests. In such situations, simply having the required technical, management, or operational controls in place may not be sufficient if the providers that implement and manage those controls are not operating in a manner consistent with the interests of the consuming organizations. Actions that organizations take to address such concerns include requiring background checks for selected service provider personnel; examining ownership records; employing only trustworthy service providers, such as providers with which organizations have had successful trust relationships; and conducting routine, periodic, unscheduled visits to service provider facilities.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(4)

SA-9(4) External System Services | Consistent Interests of Consumers and Providers
Family: System and Services Acquisition (SA) > SA-9 External System Services

Take the following actions to verify that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests: [Assignment: organization-defined actions].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(5) > Discussion

SA-9(5) Processing, Storage, and Service Location - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

The location of information processing, information and data storage, or system services can have a direct impact on the ability of organizations to successfully execute their mission and business functions. The impact occurs when external providers control the location of processing, storage, or services. The criteria that external providers use for the selection of processing, storage, or service locations may be different from the criteria that organizations use. For example, organizations may desire that data or information storage locations be restricted to certain locations to help facilitate incident response activities in case of information security incidents or breaches. Incident response activities, including forensic analyses and after-the-fact investigations, may be adversely affected by the governing laws, policies, or protocols in the locations where processing and storage occur and/or the locations from which system services emanate.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(5)

SA-9(5) External System Services | Processing, Storage, and Service Location
Family: System and Services Acquisition (SA) > SA-9 External System Services

Restrict the location of [Selection; one or more: information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(6) > Discussion

SA-9(6) Organization-controlled Cryptographic Keys - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

Maintaining exclusive control of cryptographic keys in an external system prevents decryption of organizational data by external system staff. Organizational control of cryptographic keys can be implemented by encrypting and decrypting data inside the organization as data is sent to and received from the external system or by employing a component that permits encryption and decryption functions to be local to the external system but allows exclusive organizational access to the encryption keys.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(6)

SA-9(6) External System Services | Organization-controlled Cryptographic Keys
Family: System and Services Acquisition (SA) > SA-9 External System Services

Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(7) > Discussion

SA-9(7) Organization-controlled Integrity Checking - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

Storage of organizational information in an external system could limit visibility into the security status of its data. The ability of the organization to verify and validate the integrity of its stored data without transferring it out of the external system provides such visibility.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(7)

SA-9(7) External System Services | Organization-controlled Integrity Checking
Family: System and Services Acquisition (SA) > SA-9 External System Services

Provide the capability to check the integrity of information while it resides in the external system.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(8) > Discussion

SA-9(8) Processing and Storage Location - U.S. Jurisdiction - Discussion
Family: System and Services Acquisition (SA) > SA-9 External System Services

The geographic location of information processing and data storage can have a direct impact on the ability of organizations to successfully execute their mission and business functions. A compromise or breach of high impact information and systems can have severe or catastrophic adverse impacts on organizational assets and operations, individuals, other organizations, and the Nation. Restricting the processing and storage of high-impact information to facilities within the legal jurisdictional boundary of the United States provides greater control over such processing and storage.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-9 > SA-9(8)

SA-9(8) External System Services | Processing and Storage Location - U.S. Jurisdiction
Family: System and Services Acquisition (SA) > SA-9 External System Services

Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10

SA-10 Developer Configuration Management
Family: System and Services Acquisition (SA)

Require the developer of the system, system component, or system service to:
a. Perform configuration management during system, component, or service [Selection; one or more: design; development; implementation; operation; disposal];
b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items];
c. Implement only organization-approved changes to the system, component, or service;
d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and
e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > Discussion

SA-10 Developer Configuration Management - Discussion
Family: System and Services Acquisition (SA)

Organizations consider the quality and completeness of configuration management activities conducted by developers as direct evidence of applying effective security controls. Controls include protecting the master copies of material used to generate security-relevant portions of the system hardware, software, and firmware from unauthorized modification or destruction. Maintaining the integrity of changes to the system, system component, or system service requires strict configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.

The configuration items that are placed under configuration management include the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the current running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and source code with previous versions; and test fixtures and documentation. Depending on the mission and business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance stage of the system development life cycle.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > SA-10(1) > Discussion

SA-10(1) Software and Firmware Integrity Verification - Discussion
Family: System and Services Acquisition (SA) > SA-10 Developer Configuration Management

Software and firmware integrity verification allows organizations to detect unauthorized changes to software and firmware components using developer-provided tools, techniques, and mechanisms. The integrity checking mechanisms can also address counterfeiting of software and firmware components. Organizations verify the integrity of software and firmware components, for example, through secure one-way hashes provided by developers. Delivered software and firmware components also include any updates to such components.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > SA-10(1)

SA-10(1) Developer Configuration Management | Software and Firmware Integrity Verification
Family: System and Services Acquisition (SA) > SA-10 Developer Configuration Management

Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > SA-10(2) > Discussion

SA-10(2) Alternative Configuration Management Processes - Discussion
Family: System and Services Acquisition (SA) > SA-10 Developer Configuration Management

Alternate configuration management processes may be required when organizations use commercial off-the-shelf information technology products. Alternate configuration management processes include organizational personnel who review and approve proposed changes to systems, system components, and system services and conduct security and privacy impact analyses prior to the implementation of changes to systems, components, or services.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > SA-10(2)

SA-10(2) Developer Configuration Management | Alternative Configuration Management Processes
Family: System and Services Acquisition (SA) > SA-10 Developer Configuration Management

Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > SA-10(3) > Discussion

SA-10(3) Hardware Integrity Verification - Discussion
Family: System and Services Acquisition (SA) > SA-10 Developer Configuration Management

Hardware integrity verification allows organizations to detect unauthorized changes to hardware components using developer-provided tools, techniques, methods, and mechanisms. Organizations may verify the integrity of hardware components with hard-to-copy labels, verifiable serial numbers provided by developers, and by requiring the use of anti-tamper technologies. Delivered hardware components also include hardware and firmware updates to such components.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > SA-10(3)

SA-10(3) Developer Configuration Management | Hardware Integrity Verification
Family: System and Services Acquisition (SA) > SA-10 Developer Configuration Management

Require the developer of the system, system component, or system service to enable integrity verification of hardware components.
Security and Privacy Controls for Information Systems and Organizations
SA > SA-10 > SA-10(4) > Discussion

SA-10(4) Trusted Generation - Discussion
Family: System and Services Acquisition (SA) > SA-10 Developer Configuration Management

The trusted generation of descriptions, source code, and object code addresses authorized changes to hardware, software, and firmware components between versions during development. The focus is on the efficacy of the configuration management process by the developer to ensure that newly generated versions of security-relevant hardware descriptions, source code, and object code continue to enforce the security policy for the system, system component, or system service. In contrast, [SA-10(1)](#sa-10.1) and [SA-10(3)](#sa-10.3) allow organizations to detect unauthorized changes to hardware, software, and firmware components using tools, techniques, or mechanisms provided by developers.