ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(16) > Assessment Methods

IA-5(16) In-person or Trusted External Party Authenticator Issuance - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identifier management

system security plan

system design documentation

mechanisms providing dynamic binding of identifiers and authenticators

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identification and authentication management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing account management capability

mechanisms supporting and/or implementing identification and authentication management capabilities for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(16) > Assessment Objective

IA-5(16) In-person or Trusted External Party Authenticator Issuance - Assessment Objective
Determine if the following are satisfied:

the issuance of [Assignment: organization-defined types of and/or specific authenticators] is required to be conducted [Selection: in person; by a trusted external party] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(17) > Assessment Methods

IA-5(17) Presentation Attack Detection for Biometric Authenticators - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identifier management

system security plan

system design documentation

mechanisms providing dynamic binding of identifiers and authenticators

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identification and authentication management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing account management capability

mechanisms supporting and/or implementing identification and authentication management capabilities for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(17) > Assessment Objective

IA-5(17) Presentation Attack Detection for Biometric Authenticators - Assessment Objective
Determine if the following are satisfied:

presentation attack detection mechanisms are employed for biometric-based authentication.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(18) > Assessment Methods

IA-5(18) Password Managers - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identifier management

system security plan

system design documentation

mechanisms providing dynamic binding of identifiers and authenticators

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with identification and authentication management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Mechanisms supporting and/or implementing account management capability

mechanisms supporting and/or implementing identification and authentication management capabilities for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-5 > IA-5(18) > Assessment Objective

IA-5(18) Password Managers - Assessment Objective
Determine if the following are satisfied:

IA-05(18)(a) [Assignment: organization-defined password managers] are employed to generate and manage passwords;
IA-05(18)(b) the passwords are protected using [Assignment: organization-defined controls].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-6 > Assessment Methods

IA-6 Authentication Feedback - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing authenticator feedback

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing the obscuring of feedback of authentication information during authentication
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-6 > Assessment Objective

IA-6 Authentication Feedback - Assessment Objective
Determine if the following are satisfied:

the feedback of authentication information is obscured during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-7 > Assessment Methods

IA-7 Cryptographic Module Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing cryptographic module authentication

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with responsibility for cryptographic module authentication

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms supporting and/or implementing cryptographic module authentication
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-7 > Assessment Objective

IA-7 Cryptographic Module Authentication - Assessment Objective
Determine if the following are satisfied:

mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > Assessment Methods

IA-8 Identification and Authentication (Non-organizational Users) - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

privacy plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of system accounts

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

organizational personnel with account management responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > Assessment Objective

IA-8 Identification and Authentication (Non-organizational Users) - Assessment Objective
Determine if the following are satisfied:

non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(1) > Assessment Methods

IA-8(1) Acceptance of PIV Credentials from Other Agencies - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

PIV verification records

evidence of PIV credentials

PIV credential authorizations

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with account management responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities

mechanisms that accept and verify PIV credentials
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(1) > Assessment Objective

IA-8(1) Acceptance of PIV Credentials from Other Agencies - Assessment Objective
Determine if the following are satisfied:

IA-08(01)[01] Personal Identity Verification-compliant credentials from other federal agencies are accepted;
IA-08(01)[02] Personal Identity Verification-compliant credentials from other federal agencies are electronically verified.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(2) > Assessment Methods

IA-8(2) Acceptance of External Authenticators - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

list of third-party credentialing products, components, or services procured and implemented by organization

third-party credential verification records

evidence of third-party credentials

third-party credential authorizations

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with account management responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities

mechanisms that accept external credentials
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(2) > Assessment Objective

IA-8(2) Acceptance of External Authenticators - Assessment Objective
Determine if the following are satisfied:

IA-08(02)(a) only external authenticators that are NIST-compliant are accepted;
IA-08(02)(b)[01] a list of accepted external authenticators is documented;
IA-08(02)(b)[02] a list of accepted external authenticators is maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(4) > Assessment Methods

IA-8(4) Use of Defined Profiles - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with account management responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities

mechanisms supporting and/or implementing conformance with profiles
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(4) > Assessment Objective

IA-8(4) Use of Defined Profiles - Assessment Objective
Determine if the following are satisfied:

there is conformance with [Assignment: organization-defined identity management profiles] for identity management.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(5) > Assessment Methods

IA-8(5) Acceptance of PIV-I Credentials - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

PIV-I verification records

evidence of PIV-I credentials

PIV-I credential authorizations

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with account management responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities

mechanisms that accept and verify PIV-I credentials
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(5) > Assessment Objective

IA-8(5) Acceptance of PIV-I Credentials - Assessment Objective
Determine if the following are satisfied:

IA-08(05)[01] federated or PKI credentials that meet [Assignment: organization-defined policy] are accepted;
IA-08(05)[02] federated or PKI credentials that meet [Assignment: organization-defined policy] are verified.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(6) > Assessment Methods

IA-8(6) Disassociability - Assessment Methods and Objects

Examine: Identification and authentication policy

system security plan

privacy plan

procedures addressing user identification and authentication

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

organizational personnel with account management responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-8 > IA-8(6) > Assessment Objective

IA-8(6) Disassociability - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined measures] to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-9 > Assessment Methods

IA-9 Service Identification and Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing service identification and authentication

system security plan

system design documentation

security safeguards used to identify and authenticate system services

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Security safeguards implementing service identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-9 > Assessment Objective

IA-9 Service Identification and Authentication - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined system services and applications] are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-10 > Assessment Methods

IA-10 Adaptive Authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing adaptive/supplemental identification and authentication techniques or mechanisms

system security plan

system design documentation

system configuration settings and associated documentation

supplemental identification and authentication techniques or mechanisms

system audit records

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-10 > Assessment Objective

IA-10 Adaptive Authentication - Assessment Objective
Determine if the following are satisfied:

individuals accessing the system are required to employ [Assignment: organization-defined supplemental authentication techniques or mechanisms] under specific [Assignment: organization-defined circumstances or situations].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-11 > Assessment Methods

IA-11 Re-authentication - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing user and device re-authentication

system security plan

system design documentation

system configuration settings and associated documentation

list of circumstances or situations requiring re-authentication

system audit records

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-11 > Assessment Objective

IA-11 Re-authentication - Assessment Objective
Determine if the following are satisfied:

users are required to re-authenticate when [Assignment: organization-defined circumstances or situations].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > Assessment Methods

IA-12 Identity Proofing - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identity proofing

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security and privacy responsibilities

legal counsel

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > Assessment Objective

IA-12 Identity Proofing - Assessment Objective
Determine if the following are satisfied:

IA-12a. users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed;
IA-12b. user identities are resolved to a unique individual;
IA-12c.[01] identity evidence is collected;
IA-12c.[02] identity evidence is validated;
IA-12c.[03] identity evidence is verified.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(1) > Assessment Methods

IA-12(1) Supervisor Authorization - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identity proofing

system security plan

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(1) > Assessment Objective

IA-12(1) Supervisor Authorization - Assessment Objective
Determine if the following are satisfied:

the registration process to receive an account for logical access includes supervisor or sponsor authorization.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(2) > Assessment Methods

IA-12(2) Identity Evidence - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identity proofing

system security plan

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(2) > Assessment Objective

IA-12(2) Identity Evidence - Assessment Objective
Determine if the following are satisfied:

evidence of individual identification is presented to the registration authority.
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(3) > Assessment Methods

IA-12(3) Identity Evidence Validation and Verification - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identity proofing

system security plan

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(3) > Assessment Objective

IA-12(3) Identity Evidence Validation and Verification - Assessment Objective
Determine if the following are satisfied:

the presented identity evidence is validated and verified through [Assignment: organization-defined methods of validation and verification].
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(4) > Assessment Methods

IA-12(4) In-person Validation and Verification - Assessment Methods and Objects

Examine: Identification and authentication policy

procedures addressing identity proofing

system security plan

other relevant documents or records

Interview: Organizational personnel with system operations responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

organizational personnel with identification and authentication responsibilities

Test: Mechanisms supporting and/or implementing identification and authentication capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
IA > IA-12 > IA-12(4) > Assessment Objective

IA-12(4) In-person Validation and Verification - Assessment Objective
Determine if the following are satisfied:

the validation and verification of identity evidence is conducted in person before a designated registration authority.