ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(2)

AU-10(2) Non-repudiation | Validate Binding of Information Producer Identity
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

(a) Validate the binding of the information producer identity to the information at [Assignment: organization-defined frequency] ; and
(b) Perform [Assignment: organization-defined actions] in the event of a validation error.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(3) > Discussion

AU-10(3) Chain of Custody - Discussion
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

Chain of custody is a process that tracks the movement of evidence through its collection, safeguarding, and analysis life cycle by documenting each individual who handled the evidence, the date and time the evidence was collected or transferred, and the purpose for the transfer. If the reviewer is a human or if the review function is automated but separate from the release or transfer function, the system associates the identity of the reviewer of the information to be released with the information and the information label. In the case of human reviews, maintaining the credentials of reviewers or releasers provides the organization with the means to identify who reviewed and released the information. In the case of automated reviews, it ensures that only approved review functions are used.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(3)

AU-10(3) Non-repudiation | Chain of Custody
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(4) > Discussion

AU-10(4) Validate Binding of Information Reviewer Identity - Discussion
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

Validating the binding of the information reviewer identity to the information at transfer or release points prevents the unauthorized modification of information between review and the transfer or release. The validation of bindings can be achieved by using cryptographic checksums. Organizations determine if validations are in response to user requests or generated automatically.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-10 > AU-10(4)

AU-10(4) Non-repudiation | Validate Binding of Information Reviewer Identity
Family: Audit and Accountability (AU) > AU-10 Non-repudiation

(a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: organization-defined security domains] ; and
(b) Perform [Assignment: organization-defined actions] in the event of a validation error.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-11

AU-11 Audit Record Retention
Family: Audit and Accountability (AU)

Retain audit records for [Assignment: organization-defined time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-11 > Discussion

AU-11 Audit Record Retention - Discussion
Family: Audit and Accountability (AU)

Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-11 > AU-11(1) > Discussion

AU-11(1) Long-term Retrieval Capability - Discussion
Family: Audit and Accountability (AU) > AU-11 Audit Record Retention

Organizations need to access and read audit records requiring long-term storage (on the order of years). Measures employed to help facilitate the retrieval of audit records include converting records to newer formats, retaining equipment capable of reading the records, and retaining the necessary documentation to help personnel understand how to interpret the records.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-11 > AU-11(1)

AU-11(1) Audit Record Retention | Long-term Retrieval Capability
Family: Audit and Accountability (AU) > AU-11 Audit Record Retention

Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12

AU-12 Audit Record Generation
Family: Audit and Accountability (AU)

a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: organization-defined system components];
b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > Discussion

AU-12 Audit Record Generation - Discussion
Family: Audit and Accountability (AU)

Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(1) > Discussion

AU-12(1) System-wide and Time-correlated Audit Trail - Discussion
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(1)

AU-12(1) Audit Record Generation | System-wide and Time-correlated Audit Trail
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(2) > Discussion

AU-12(2) Standardized Formats - Discussion
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Audit records that follow common standards promote interoperability and information exchange between devices and systems. Promoting interoperability and information exchange facilitates the production of event information that can be readily analyzed and correlated. If logging mechanisms do not conform to standardized formats, systems may convert individual audit records into standardized formats when compiling system-wide audit trails.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(2)

AU-12(2) Audit Record Generation | Standardized Formats
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(3) > Discussion

AU-12(3) Changes by Authorized Individuals - Discussion
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(3)

AU-12(3) Audit Record Generation | Changes by Authorized Individuals
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(4) > Discussion

AU-12(4) Query Parameter Audits of Personally Identifiable Information - Discussion
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-12 > AU-12(4)

AU-12(4) Audit Record Generation | Query Parameter Audits of Personally Identifiable Information
Family: Audit and Accountability (AU) > AU-12 Audit Record Generation

Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13

AU-13 Monitoring for Information Disclosure
Family: Audit and Accountability (AU)

a. Monitor [Assignment: organization-defined open-source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information; and
b. If an information disclosure is discovered:
1. Notify [Assignment: organization-defined personnel or roles] ; and
2. Take the following additional actions: [Assignment: organization-defined additional actions].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13 > Discussion

AU-13 Monitoring for Information Disclosure - Discussion
Family: Audit and Accountability (AU)

Unauthorized disclosure of information is a form of data leakage. Open-source information includes social networking sites and code-sharing platforms and repositories. Examples of organizational information include personally identifiable information retained by the organization or proprietary information generated by the organization.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13 > AU-13(1) > Discussion

AU-13(1) Use of Automated Tools - Discussion
Family: Audit and Accountability (AU) > AU-13 Monitoring for Information Disclosure

Automated mechanisms include commercial services that provide notifications and alerts to organizations and automated scripts to monitor new posts on websites.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13 > AU-13(1)

AU-13(1) Monitoring for Information Disclosure | Use of Automated Tools
Family: Audit and Accountability (AU) > AU-13 Monitoring for Information Disclosure

Monitor open-source information and information sites using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13 > AU-13(2) > Discussion

AU-13(2) Review of Monitored Sites - Discussion
Family: Audit and Accountability (AU) > AU-13 Monitoring for Information Disclosure

Reviewing the current list of open-source information sites being monitored on a regular basis helps to ensure that the selected sites remain relevant. The review also provides the opportunity to add new open-source information sites with the potential to provide evidence of unauthorized disclosure of organizational information. The list of sites monitored can be guided and informed by threat intelligence of other credible sources of information.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13 > AU-13(2)

AU-13(2) Monitoring for Information Disclosure | Review of Monitored Sites
Family: Audit and Accountability (AU) > AU-13 Monitoring for Information Disclosure

Review the list of open-source information sites being monitored [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13 > AU-13(3) > Discussion

AU-13(3) Unauthorized Replication of Information - Discussion
Family: Audit and Accountability (AU) > AU-13 Monitoring for Information Disclosure

The unauthorized use or replication of organizational information by external entities can cause adverse impacts on organizational operations and assets, including damage to reputation. Such activity can include the replication of an organizational website by an adversary or hostile threat actor who attempts to impersonate the web-hosting organization. Discovery tools, techniques, and processes used to determine if external entities are replicating organizational information in an unauthorized manner include scanning external websites, monitoring social media, and training staff to recognize the unauthorized use of organizational information.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-13 > AU-13(3)

AU-13(3) Monitoring for Information Disclosure | Unauthorized Replication of Information
Family: Audit and Accountability (AU) > AU-13 Monitoring for Information Disclosure

Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-14

AU-14 Session Audit
Family: Audit and Accountability (AU)

a. Provide and implement the capability for [Assignment: organization-defined users or roles] to [Selection; one or more: record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances] ; and
b. Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-14 > Discussion

AU-14 Session Audit - Discussion
Family: Audit and Accountability (AU)

Session audits can include monitoring keystrokes, tracking websites visited, and recording information and/or file transfers. Session audit capability is implemented in addition to event logging and may involve implementation of specialized session capture technology. Organizations consider how session auditing can reveal information about individuals that may give rise to privacy risk as well as how to mitigate those risks. Because session auditing can impact system and network performance, organizations activate the capability under well-defined situations (e.g., the organization is suspicious of a specific individual). Organizations consult with legal counsel, civil liberties officials, and privacy officials to ensure that any legal, privacy, civil rights, or civil liberties issues, including the use of personally identifiable information, are appropriately addressed.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-14 > AU-14(1) > Discussion

AU-14(1) System Start-up - Discussion
Family: Audit and Accountability (AU) > AU-14 Session Audit

The automatic initiation of session audits at startup helps to ensure that the information being captured on selected individuals is complete and not subject to compromise through tampering by malicious threat actors.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-14 > AU-14(1)

AU-14(1) Session Audit | System Start-up
Family: Audit and Accountability (AU) > AU-14 Session Audit

Initiate session audits automatically at system start-up.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-14 > AU-14(3)

AU-14(3) Session Audit | Remote Viewing and Listening
Family: Audit and Accountability (AU) > AU-14 Session Audit

Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16

AU-16 Cross-organizational Audit Logging
Family: Audit and Accountability (AU)

Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16 > Discussion

AU-16 Cross-organizational Audit Logging - Discussion
Family: Audit and Accountability (AU)

When organizations use systems or services of external organizations, the audit logging capability necessitates a coordinated, cross-organization approach. For example, maintaining the identity of individuals who request specific services across organizational boundaries may often be difficult, and doing so may prove to have significant performance and privacy ramifications. Therefore, it is often the case that cross-organizational audit logging simply captures the identity of individuals who issue requests at the initial system, and subsequent systems record that the requests originated from authorized individuals. Organizations consider including processes for coordinating audit information requirements and protection of audit information in information exchange agreements.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16 > AU-16(1) > Discussion

AU-16(1) Identity Preservation - Discussion
Family: Audit and Accountability (AU) > AU-16 Cross-organizational Audit Logging

Identity preservation is applied when there is a need to be able to trace actions that are performed across organizational boundaries to a specific individual.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16 > AU-16(1)

AU-16(1) Cross-organizational Audit Logging | Identity Preservation
Family: Audit and Accountability (AU) > AU-16 Cross-organizational Audit Logging

Preserve the identity of individuals in cross-organizational audit trails.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16 > AU-16(2) > Discussion

AU-16(2) Sharing of Audit Information - Discussion
Family: Audit and Accountability (AU) > AU-16 Cross-organizational Audit Logging

Due to the distributed nature of the audit information, cross-organization sharing of audit information may be essential for effective analysis of the auditing being performed. For example, the audit records of one organization may not provide sufficient information to determine the appropriate or inappropriate use of organizational information resources by individuals in other organizations. In some instances, only individuals' home organizations have the appropriate knowledge to make such determinations, thus requiring the sharing of audit information among organizations.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16 > AU-16(2)

AU-16(2) Cross-organizational Audit Logging | Sharing of Audit Information
Family: Audit and Accountability (AU) > AU-16 Cross-organizational Audit Logging

Provide cross-organizational audit information to [Assignment: organization-defined organizations] based on [Assignment: organization-defined cross-organizational sharing agreements].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16 > AU-16(3) > Discussion

AU-16(3) Disassociability - Discussion
Family: Audit and Accountability (AU) > AU-16 Cross-organizational Audit Logging

Preserving identities in audit trails could have privacy ramifications, such as enabling the tracking and profiling of individuals, but may not be operationally necessary. These risks could be further amplified when transmitting information across organizational boundaries. Implementing privacy-enhancing cryptographic techniques can disassociate individuals from audit information and reduce privacy risk while maintaining accountability.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-16 > AU-16(3)

AU-16(3) Cross-organizational Audit Logging | Disassociability
Family: Audit and Accountability (AU) > AU-16 Cross-organizational Audit Logging

Implement [Assignment: organization-defined measures] to disassociate individuals from audit information transmitted across organizational boundaries.
Security and Privacy Controls for Information Systems and Organizations
CA > CA-1

CA-1 Policy and Procedures
Family: Assessment, Authorization, and Monitoring (CA)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and
c. Review and update the current assessment, authorization, and monitoring:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].