ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SR > SR-5 > Discussion

SR-5 Acquisition Strategies, Tools, and Methods - Discussion
Family: Supply Chain Risk Management (SR)

The use of the acquisition process provides an important vehicle to protect the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind or filtered buys, requiring tamper-evident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can guide and inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, insertion of counterfeits, insertion of malicious software or backdoors, and poor development practices throughout the system development life cycle. Organizations also consider providing incentives for suppliers who implement controls, promote transparency into their processes and security and privacy practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risk, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security and privacy requirements of the organization. Contracts may specify documentation protection requirements.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-5 > SR-5(1) > Discussion

SR-5(1) Adequate Supply - Discussion
Family: Supply Chain Risk Management (SR) > SR-5 Acquisition Strategies, Tools, and Methods

Adversaries can attempt to impede organizational operations by disrupting the supply of critical system components or corrupting supplier operations. Organizations may track systems and component mean time to failure to mitigate the loss of temporary or permanent system function. Controls to ensure that adequate supplies of critical system components include the use of multiple suppliers throughout the supply chain for the identified critical components, stockpiling spare components to ensure operation during mission-critical times, and the identification of functionally identical or similar components that may be used, if necessary.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-5 > SR-5(1)

SR-5(1) Acquisition Strategies, Tools, and Methods | Adequate Supply
Family: Supply Chain Risk Management (SR) > SR-5 Acquisition Strategies, Tools, and Methods

Employ the following controls to ensure an adequate supply of [Assignment: organization-defined critical system components]: [Assignment: organization-defined controls].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-5 > SR-5(2) > Discussion

SR-5(2) Assessments Prior to Selection, Acceptance, Modification, or Update - Discussion
Family: Supply Chain Risk Management (SR) > SR-5 Acquisition Strategies, Tools, and Methods

Organizational personnel or independent, external entities conduct assessments of systems, components, products, tools, and services to uncover evidence of tampering, unintentional and intentional vulnerabilities, or evidence of non-compliance with supply chain controls. These include malicious code, malicious processes, defective software, backdoors, and counterfeits. Assessments can include evaluations; design proposal reviews; visual or physical inspection; static and dynamic analyses; visual, x-ray, or magnetic particle inspections; simulations; white, gray, or black box testing; fuzz testing; stress testing; and penetration testing (see [SR-6(1)](#sr-6.1) ). Evidence generated during assessments is documented for follow-on actions by organizations. The evidence generated during the organizational or independent assessments of supply chain elements may be used to improve supply chain processes and inform the supply chain risk management process. The evidence can be leveraged in follow-on assessments. Evidence and other documentation may be shared in accordance with organizational agreements.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-5 > SR-5(2)

SR-5(2) Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or Update
Family: Supply Chain Risk Management (SR) > SR-5 Acquisition Strategies, Tools, and Methods

Assess the system, system component, or system service prior to selection, acceptance, modification, or update.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-6

SR-6 Supplier Assessments and Reviews
Family: Supply Chain Risk Management (SR)

Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-6 > Discussion

SR-6 Supplier Assessments and Reviews - Discussion
Family: Supply Chain Risk Management (SR)

An assessment and review of supplier risk includes security and supply chain risk management processes, foreign ownership, control or influence (FOCI), and the ability of the supplier to effectively assess subordinate second-tier and third-tier suppliers and contractors. The reviews may be conducted by the organization or by an independent third party. The reviews consider documented processes, documented controls, all-source intelligence, and publicly available information related to the supplier or contractor. Organizations can use open-source information to monitor for indications of stolen information, poor development and quality control practices, information spillage, or counterfeits. In some cases, it may be appropriate or required to share assessment and review results with other organizations in accordance with any applicable rules, policies, or inter-organizational agreements or contracts.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-6 > SR-6(1) > Discussion

SR-6(1) Testing and Analysis - Discussion
Family: Supply Chain Risk Management (SR) > SR-6 Supplier Assessments and Reviews

Relationships between entities and procedures within the supply chain, including development and delivery, are considered. Supply chain elements include organizations, entities, or tools that are used for the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems, system components, or system services. Supply chain processes include supply chain risk management programs; SCRM strategies and implementation plans; personnel and physical security programs; hardware, software, and firmware development processes; configuration management tools, techniques, and measures to maintain provenance; shipping and handling procedures; and programs, processes, or procedures associated with the production and distribution of supply chain elements. Supply chain actors are individuals with specific roles and responsibilities in the supply chain. The evidence generated and collected during analyses and testing of supply chain elements, processes, and actors is documented and used to inform organizational risk management activities and decisions.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-6 > SR-6(1)

SR-6(1) Supplier Assessments and Reviews | Testing and Analysis
Family: Supply Chain Risk Management (SR) > SR-6 Supplier Assessments and Reviews

Employ [Selection; one or more: organizational analysis; independent third-party analysis; organizational testing; independent third-party testing] of the following supply chain elements, processes, and actors associated with the system, system component, or system service: [Assignment: organization-defined supply chain elements, processes, and actors].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-7

SR-7 Supply Chain Operations Security
Family: Supply Chain Risk Management (SR)

Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [Assignment: organization-defined OPSEC controls].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-7 > Discussion

SR-7 Supply Chain Operations Security - Discussion
Family: Supply Chain Risk Management (SR)

Supply chain OPSEC expands the scope of OPSEC to include suppliers and potential suppliers. OPSEC is a process that includes identifying critical information, analyzing friendly actions related to operations and other activities to identify actions that can be observed by potential adversaries, determining indicators that potential adversaries might obtain that could be interpreted or pieced together to derive information in sufficient time to cause harm to organizations, implementing safeguards or countermeasures to eliminate or reduce exploitable vulnerabilities and risk to an acceptable level, and considering how aggregated information may expose users or specific uses of the supply chain. Supply chain information includes user identities; uses for systems, system components, and system services; supplier identities; security and privacy requirements; system and component configurations; supplier processes; design specifications; and testing and evaluation results. Supply chain OPSEC may require organizations to withhold mission or business information from suppliers and may include the use of intermediaries to hide the end use or users of systems, system components, or system services.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-8

SR-8 Notification Agreements
Family: Supply Chain Risk Management (SR)

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection; one or more: notification of supply chain compromises; [Assignment: organization-defined results of assessments or audits] ].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-8 > Discussion

SR-8 Notification Agreements - Discussion
Family: Supply Chain Risk Management (SR)

The establishment of agreements and procedures facilitates communications among supply chain entities. Early notification of compromises and potential compromises in the supply chain that can potentially adversely affect or have adversely affected organizational systems or system components is essential for organizations to effectively respond to such incidents. The results of assessments or audits may include open-source information that contributed to a decision or result and could be used to help the supply chain entity resolve a concern or improve its processes.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-9

SR-9 Tamper Resistance and Detection
Family: Supply Chain Risk Management (SR)

Implement a tamper protection program for the system, system component, or system service.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-9 > Discussion

SR-9 Tamper Resistance and Detection - Discussion
Family: Supply Chain Risk Management (SR)

Anti-tamper technologies, tools, and techniques provide a level of protection for systems, system components, and services against many threats, including reverse engineering, modification, and substitution. Strong identification combined with tamper resistance and/or tamper detection is essential to protecting systems and components during distribution and when in use.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-9 > SR-9(1) > Discussion

SR-9(1) Multiple Stages of System Development Life Cycle - Discussion
Family: Supply Chain Risk Management (SR) > SR-9 Tamper Resistance and Detection

The system development life cycle includes research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal. Organizations use a combination of hardware and software techniques for tamper resistance and detection. Organizations use obfuscation and self-checking to make reverse engineering and modifications more difficult, time-consuming, and expensive for adversaries. The customization of systems and system components can make substitutions easier to detect and therefore limit damage.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-9 > SR-9(1)

SR-9(1) Tamper Resistance and Detection | Multiple Stages of System Development Life Cycle
Family: Supply Chain Risk Management (SR) > SR-9 Tamper Resistance and Detection

Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-10

SR-10 Inspection of Systems or Components
Family: Supply Chain Risk Management (SR)

Inspect the following systems or system components [Selection; one or more: at random; at [Assignment: organization-defined frequency] ; upon [Assignment: organization-defined indications of need for inspection] ] to detect tampering: [Assignment: organization-defined systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-10 > Discussion

SR-10 Inspection of Systems or Components - Discussion
Family: Supply Chain Risk Management (SR)

The inspection of systems or systems components for tamper resistance and detection addresses physical and logical tampering and is applied to systems and system components removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-11

SR-11 Component Authenticity
Family: Supply Chain Risk Management (SR)

a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
b. Report counterfeit system components to [Selection; one or more: source of counterfeit component; [Assignment: organization-defined external reporting organizations] ; [Assignment: organization-defined personnel or roles] ].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-11 > Discussion

SR-11 Component Authenticity - Discussion
Family: Supply Chain Risk Management (SR)

Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.
Security and Privacy Controls for Information Systems and Organizations
SR > SR-11 > SR-11(1)

SR-11(1) Component Authenticity | Anti-counterfeit Training
Family: Supply Chain Risk Management (SR) > SR-11 Component Authenticity

Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).
Security and Privacy Controls for Information Systems and Organizations
SR > SR-11 > SR-11(2)

SR-11(2) Component Authenticity | Configuration Control for Component Service and Repair
Family: Supply Chain Risk Management (SR) > SR-11 Component Authenticity

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system components].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-11 > SR-11(3) > Discussion

SR-11(3) Anti-counterfeit Scanning - Discussion
Family: Supply Chain Risk Management (SR) > SR-11 Component Authenticity

The type of component determines the type of scanning to be conducted (e.g., web application scanning if the component is a web application).
Security and Privacy Controls for Information Systems and Organizations
SR > SR-11 > SR-11(3)

SR-11(3) Component Authenticity | Anti-counterfeit Scanning
Family: Supply Chain Risk Management (SR) > SR-11 Component Authenticity

Scan for counterfeit system components [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-12

SR-12 Component Disposal
Family: Supply Chain Risk Management (SR)

Dispose of [Assignment: organization-defined data, documentation, tools, or system components] using the following techniques and methods: [Assignment: organization-defined techniques and methods].
Security and Privacy Controls for Information Systems and Organizations
SR > SR-12 > Discussion

SR-12 Component Disposal - Discussion
Family: Supply Chain Risk Management (SR)

Data, documentation, tools, or system components can be disposed of at any time during the system development life cycle (not only in the disposal or retirement phase of the life cycle). For example, disposal can occur during research and development, design, prototyping, or operations/maintenance and include methods such as disk cleaning, removal of cryptographic keys, partial reuse of components. Opportunities for compromise during disposal affect physical and logical data, including system documentation in paper-based or digital files; shipping and delivery documentation; memory sticks with software code; or complete routers or servers that include permanent media, which contain sensitive or proprietary information. Additionally, proper disposal of system components helps to prevent such components from entering the gray market.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
1.0 INTRODUCTION

1.0 INTRODUCTION

The identification of information processed on an information system is essential to the proper
selection of security controls and ensuring the confidentiality, integrity, and availability of the
Publication (SP) 800-60 has been developed to assist Federal government agencies to categorize
information and information systems.
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
1.1 Purpose and Applicability

1.1 Purpose and Applicability

NIST SP 800-60 addresses the FISMA direction to develop guidelines recommending the types
of information and information systems to be included in each category of potential security
impact. This guideline is intended to help agencies consistently map security impact levels to
types of: (i) information (e.g., privacy, medical, proprietary, financial, contractor sensitive, trade
secret, investigation); and (ii) information systems (e.g., mission critical, mission support,
administrative). This guideline applies to all Federal information systems other than national
security systems. National security systems store, process, or communicate national security
information.2
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
1.2 Target Audience

1.2 Target Audience

This publication is intended to serve a diverse federal audience of information system and
information security professionals including: (i) individuals with information system and
information security management and oversight responsibilities (e.g., chief information officers,
senior agency information security officers, authorizing officials); (ii) organizational officials
having a vested interest in the accomplishment of organizational missions (e.g., mission and
business area owners, information owners); (iii) individuals with information system
development responsibilities (e.g., program and project managers, information system
developers); and (iv) individuals with information security implementation and operational
responsibilities (e.g., information system owners, information owners, information system
security officers).
Guide for Mapping Types of Information and Information Systems to Security Categories, Volume 1
1.3 Relationship to Other Documents

1.3 Relationship to Other Documents

NIST Special Publication (SP) 800-60 is a member of the NIST family of security-related
publications including:
• FIPS Publication 199, Standards for Security Categorization of Federal Information and
Information Systems;
• FIPS Publication 200, Minimum Security Requirements for Federal Information and
Information Systems;
2 FISMA defines a national security system as any information system (including telecommunications system) used
or operated by an agency or by a contractor on behalf of an agency, or any other organization on behalf of an agency
- (i) the function, operation, or use of which: involves intelligence activities; involves cryptologic activities related
to national security; involves command and control of military forces; involves equipment that is an integral part of
a weapon or weapon system; or is critical to the direct fulfillment of military or intelligence missions (excluding a
routine administrative or business system used for applications such as payroll, finance, logistics, and personnel
management); or (ii) that processes classified information. [See Public Law 107-347, Section 3542 (b)(2)(A).]
• NIST SP 800-30, Risk Management Guide for Information Technology Systems;3
• NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal
Information Systems;
• NIST Draft SP 800-39, Managing Risk from Information Systems: An Organization
Perspective;
• NIST SP 800-53, Recommended Security Controls for Federal Information Systems;
• NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information
Systems; and
• NIST SP 800-59, Guideline for Identifying an Information System as a National Security
System.
This series of nine documents is intended to provide a structured, yet flexible framework for
selecting, specifying, employing, evaluating, and monitoring the security controls in Federal
information systems-and thus, makes a significant contribution toward satisfying the
requirements of the Federal Information Security Management Act (FISMA) of 2002. While the
publications are mutually reinforcing and have some dependencies, in most cases, they can be
effectively used independently of one another.
The SP 800-60 information types and associated security impact levels are based on the Office of
Management and Budget (OMB) Federal Enterprise Architecture Program Management Office's
October 2007 FEA Consolidated Reference Model Document, Version 2.3, inputs from
participants in previous NIST SP 800-60 workshops, and FIPS 199. Rationale for the example
impact-level recommendations provided in the appendices has been derived from multiple
sources and, as such, will require several iterations of review, comment, and subsequent
modification to achieve consistency in terminology, structure, and content.