ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
PM > PM-31 > Discussion

PM-31 Continuous Monitoring Strategy - Discussion
Family: Program Management (PM)

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CA-7](#ca-7), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b), [SI-4](#si-4).
Security and Privacy Controls for Information Systems and Organizations
PM > PM-32

PM-32 Purposing
Family: Program Management (PM)

Analyze [Assignment: organization-defined systems or system components] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-32 > Discussion

PM-32 Purposing - Discussion
Family: Program Management (PM)

Systems are designed to support a specific mission or business function. However, over time, systems and system components may be used to support services and functions that are outside of the scope of the intended mission or business functions. This can result in exposing information resources to unintended environments and uses that can significantly increase threat exposure. In doing so, the systems are more vulnerable to compromise, which can ultimately impact the services and functions for which they were intended. This is especially impactful for mission-essential services and functions. By analyzing resource use, organizations can identify such potential exposures.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-1

PS-1 Policy and Procedures
Family: Personnel Security (PS)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the personnel security policy and procedures; and
c. Review and update the current personnel security:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-1 > Discussion

PS-1 Policy and Procedures - Discussion
Family: Personnel Security (PS)

Personnel security policy and procedures for the controls in the PS family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on their development. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission level or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies reflecting the complex nature of organizations. Procedures can be established for security and privacy programs, for mission/business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to personnel security policy and procedures include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-2

PS-2 Position Risk Designation
Family: Personnel Security (PS)

a. Assign a risk designation to all organizational positions;
b. Establish screening criteria for individuals filling those positions; and
c. Review and update position risk designations [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-2 > Discussion

PS-2 Position Risk Designation - Discussion
Family: Personnel Security (PS)

Position risk designations reflect Office of Personnel Management (OPM) policy and guidance. Proper position designation is the foundation of an effective and consistent suitability and personnel security program. The Position Designation System (PDS) assesses the duties and responsibilities of a position to determine the degree of potential damage to the efficiency or integrity of the service due to misconduct of an incumbent of a position and establishes the risk level of that position. The PDS assessment also determines if the duties and responsibilities of the position present the potential for position incumbents to bring about a material adverse effect on national security and the degree of that potential effect, which establishes the sensitivity level of a position. The results of the assessment determine what level of investigation is conducted for a position. Risk designations can guide and inform the types of authorizations that individuals receive when accessing organizational information and information systems. Position screening criteria include explicit information security role appointment requirements. Parts 1400 and 731 of Title 5, Code of Federal Regulations, establish the requirements for organizations to evaluate relevant covered positions for a position sensitivity and position risk designation commensurate with the duties and responsibilities of those positions.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3

PS-3 Personnel Screening
Family: Personnel Security (PS)

a. Screen individuals prior to authorizing access to the system; and
b. Rescreen individuals in accordance with [Assignment: organization-defined organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > Discussion

PS-3 Personnel Screening - Discussion
Family: Personnel Security (PS)

Personnel screening and rescreening activities reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, and specific criteria established for the risk designations of assigned positions. Examples of personnel screening include background investigations and agency checks. Organizations may define different rescreening conditions and frequencies for personnel accessing systems based on types of information processed, stored, or transmitted by the systems.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > PS-3(1) > Discussion

PS-3(1) Classified Information - Discussion
Family: Personnel Security (PS) > PS-3 Personnel Screening

Classified information is the most sensitive information that the Federal Government processes, stores, or transmits. It is imperative that individuals have the requisite security clearances and system access authorizations prior to gaining access to such information. Access authorizations are enforced by system access controls (see [AC-3](#ac-3) ) and flow controls (see [AC-4](#ac-4)).
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > PS-3(1)

PS-3(1) Personnel Screening | Classified Information
Family: Personnel Security (PS) > PS-3 Personnel Screening

Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > PS-3(2) > Discussion

PS-3(2) Formal Indoctrination - Discussion
Family: Personnel Security (PS) > PS-3 Personnel Screening

Types of classified information that require formal indoctrination include Special Access Program (SAP), Restricted Data (RD), and Sensitive Compartmented Information (SCI).
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > PS-3(2)

PS-3(2) Personnel Screening | Formal Indoctrination
Family: Personnel Security (PS) > PS-3 Personnel Screening

Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have access on the system.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > PS-3(3) > Discussion

PS-3(3) Information Requiring Special Protective Measures - Discussion
Family: Personnel Security (PS) > PS-3 Personnel Screening

Organizational information that requires special protection includes controlled unclassified information. Personnel security criteria include position sensitivity background screening requirements.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > PS-3(3)

PS-3(3) Personnel Screening | Information Requiring Special Protective Measures
Family: Personnel Security (PS) > PS-3 Personnel Screening

Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection:
(a) Have valid access authorizations that are demonstrated by assigned official government duties; and
(b) Satisfy [Assignment: organization-defined additional personnel screening criteria].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-3 > PS-3(4)

PS-3(4) Personnel Screening | Citizenship Requirements
Family: Personnel Security (PS) > PS-3 Personnel Screening

Verify that individuals accessing a system processing, storing, or transmitting [Assignment: organization-defined information types] meet [Assignment: organization-defined citizenship requirements].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-4

PS-4 Personnel Termination
Family: Personnel Security (PS)

Upon termination of individual employment:
a. Disable system access within [Assignment: organization-defined time period];
b. Terminate or revoke any authenticators and credentials associated with the individual;
c. Conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics];
d. Retrieve all security-related organizational system-related property; and
e. Retain access to organizational information and systems formerly controlled by terminated individual.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-4 > Discussion

PS-4 Personnel Termination - Discussion
Family: Personnel Security (PS)

System property includes hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for system-related property. Security topics at exit interviews include reminding individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not always be possible for some individuals, including in cases related to the unavailability of supervisors, illnesses, or job abandonment. Exit interviews are important for individuals with security clearances. The timely execution of termination actions is essential for individuals who have been terminated for cause. In certain situations, organizations consider disabling the system accounts of individuals who are being terminated prior to the individuals being notified.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-4 > PS-4(1) > Discussion

PS-4(1) Post-employment Requirements - Discussion
Family: Personnel Security (PS) > PS-4 Personnel Termination

Organizations consult with the Office of the General Counsel regarding matters of post-employment requirements on terminated individuals.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-4 > PS-4(1)

PS-4(1) Personnel Termination | Post-employment Requirements
Family: Personnel Security (PS) > PS-4 Personnel Termination

(a) Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and
(b) Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-4 > PS-4(2) > Discussion

PS-4(2) Automated Actions - Discussion
Family: Personnel Security (PS) > PS-4 Personnel Termination

In organizations with many employees, not all personnel who need to know about termination actions receive the appropriate notifications, or if such notifications are received, they may not occur in a timely manner. Automated mechanisms can be used to send automatic alerts or notifications to organizational personnel or roles when individuals are terminated. Such automatic alerts or notifications can be conveyed in a variety of ways, including via telephone, electronic mail, text message, or websites. Automated mechanisms can also be employed to quickly and thoroughly disable access to system resources after an employee is terminated.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-4 > PS-4(2)

PS-4(2) Personnel Termination | Automated Actions
Family: Personnel Security (PS) > PS-4 Personnel Termination

Use [Assignment: organization-defined automated mechanisms] to [Selection; one or more: notify [Assignment: organization-defined personnel or roles] of individual termination actions; disable access to system resources].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-5

PS-5 Personnel Transfer
Family: Personnel Security (PS)

a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization;
b. Initiate [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action];
c. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and
d. Notify [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-5 > Discussion

PS-5 Personnel Transfer - Discussion
Family: Personnel Security (PS)

Personnel transfer applies when reassignments or transfers of individuals are permanent or of such extended duration as to make the actions warranted. Organizations define actions appropriate for the types of reassignments or transfers, whether permanent or extended. Actions that may be required for personnel transfers or reassignments to other positions within organizations include returning old and issuing new keys, identification cards, and building passes; closing system accounts and establishing new accounts; changing system access authorizations (i.e., privileges); and providing for access to official records to which individuals had access at previous work locations and in previous system accounts.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-6

PS-6 Access Agreements
Family: Personnel Security (PS)

a. Develop and document access agreements for organizational systems;
b. Review and update the access agreements [Assignment: organization-defined frequency] ; and
c. Verify that individuals requiring access to organizational information and systems:
1. Sign appropriate access agreements prior to being granted access; and
2. Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
PS > PS-6 > Discussion

PS-6 Access Agreements - Discussion
Family: Personnel Security (PS)

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with organizational systems to which access is authorized. Organizations can use electronic signatures to acknowledge access agreements unless specifically prohibited by organizational policy.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-6 > PS-6(2) > Discussion

PS-6(2) Classified Information Requiring Special Protection - Discussion
Family: Personnel Security (PS) > PS-6 Access Agreements

Classified information that requires special protection includes collateral information, Special Access Program (SAP) information, and Sensitive Compartmented Information (SCI). Personnel security criteria reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-6 > PS-6(2)

PS-6(2) Access Agreements | Classified Information Requiring Special Protection
Family: Personnel Security (PS) > PS-6 Access Agreements

Verify that access to classified information requiring special protection is granted only to individuals who:
(a) Have a valid access authorization that is demonstrated by assigned official government duties;
(b) Satisfy associated personnel security criteria; and
(c) Have read, understood, and signed a nondisclosure agreement.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-6 > PS-6(3) > Discussion

PS-6(3) Post-employment Requirements - Discussion
Family: Personnel Security (PS) > PS-6 Access Agreements

Organizations consult with the Office of the General Counsel regarding matters of post-employment requirements on terminated individuals.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-6 > PS-6(3)

PS-6(3) Access Agreements | Post-employment Requirements
Family: Personnel Security (PS) > PS-6 Access Agreements

(a) Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information; and
(b) Require individuals to sign an acknowledgment of these requirements, if applicable, as part of granting initial access to covered information.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-7

PS-7 External Personnel Security
Family: Personnel Security (PS)

a. Establish personnel security requirements, including security roles and responsibilities for external providers;
b. Require external providers to comply with personnel security policies and procedures established by the organization;
c. Document personnel security requirements;
d. Require external providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [Assignment: organization-defined time period] ; and
e. Monitor provider compliance with personnel security requirements.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-7 > Discussion

PS-7 External Personnel Security - Discussion
Family: Personnel Security (PS)

External provider refers to organizations other than the organization operating or acquiring the system. External providers include service bureaus, contractors, and other organizations that provide system development, information technology services, testing or assessment services, outsourced applications, and network/security management. Organizations explicitly include personnel security requirements in acquisition-related documents. External providers may have personnel working at organizational facilities with credentials, badges, or system privileges issued by organizations. Notifications of external personnel changes ensure the appropriate termination of privileges and credentials. Organizations define the transfers and terminations deemed reportable by security-related characteristics that include functions, roles, and the nature of credentials or privileges associated with transferred or terminated individuals.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-8

PS-8 Personnel Sanctions
Family: Personnel Security (PS)

a. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and
b. Notify [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.