ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(26)

SC-7(26) Boundary Protection | Classified National Security System Connections
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: organization-defined boundary protection device].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(27) > Discussion

SC-7(27) Unclassified Non-national Security System Connections - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between unclassified non-national security systems and external networks.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(27)

SC-7(27) Boundary Protection | Unclassified Non-national Security System Connections
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prohibit the direct connection of [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(28) > Discussion

SC-7(28) Connections to Public Networks - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

A direct connection is a dedicated physical or virtual connection between two or more systems. A public network is a network accessible to the public, including the Internet and organizational extranets with public access.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(28)

SC-7(28) Boundary Protection | Connections to Public Networks
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prohibit the direct connection of [Assignment: organization-defined system] to a public network.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(29) > Discussion

SC-7(29) Separate Subnets to Isolate Functions - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(29)

SC-7(29) Boundary Protection | Separate Subnets to Isolate Functions
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Implement [Selection: physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignment: organization-defined critical system components and functions].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8

SC-8 Transmission Confidentiality and Integrity
Family: System and Communications Protection (SC)

Protect the [Selection; one or more: confidentiality; integrity] of transmitted information.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > Discussion

SC-8 Transmission Confidentiality and Integrity - Discussion
Family: System and Communications Protection (SC)

Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques.

Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(1) > Discussion

SC-8(1) Cryptographic Protection - Discussion
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Encryption protects information from unauthorized disclosure and modification during transmission. Cryptographic mechanisms that protect the confidentiality and integrity of information during transmission include TLS and IPSec. Cryptographic mechanisms used to protect information integrity include cryptographic hash functions that have applications in digital signatures, checksums, and message authentication codes.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(1)

SC-8(1) Transmission Confidentiality and Integrity | Cryptographic Protection
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Implement cryptographic mechanisms to [Selection; one or more: prevent unauthorized disclosure of information; detect changes to information] during transmission.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(2) > Discussion

SC-8(2) Pre- and Post-transmission Handling - Discussion
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Information can be unintentionally or maliciously disclosed or modified during preparation for transmission or during reception, including during aggregation, at protocol transformation points, and during packing and unpacking. Such unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(2)

SC-8(2) Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Maintain the [Selection; one or more: confidentiality; integrity] of information during preparation for transmission and during reception.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(3) > Discussion

SC-8(3) Cryptographic Protection for Message Externals - Discussion
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Cryptographic protection for message externals addresses protection from the unauthorized disclosure of information. Message externals include message headers and routing information. Cryptographic protection prevents the exploitation of message externals and applies to internal and external networks or links that may be visible to individuals who are not authorized users. Header and routing information is sometimes transmitted in clear text (i.e., unencrypted) because the information is not identified by organizations as having significant value or because encrypting the information can result in lower network performance or higher costs. Alternative physical controls include protected distribution systems.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(3)

SC-8(3) Transmission Confidentiality and Integrity | Cryptographic Protection for Message Externals
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(4) > Discussion

SC-8(4) Conceal or Randomize Communications - Discussion
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Concealing or randomizing communication patterns addresses protection from unauthorized disclosure of information. Communication patterns include frequency, periods, predictability, and amount. Changes to communications patterns can reveal information with intelligence value, especially when combined with other available information related to the mission and business functions of the organization. Concealing or randomizing communications prevents the derivation of intelligence based on communications patterns and applies to both internal and external networks or links that may be visible to individuals who are not authorized users. Encrypting the links and transmitting in continuous, fixed, or random patterns prevents the derivation of intelligence from the system communications patterns. Alternative physical controls include protected distribution systems.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(4)

SC-8(4) Transmission Confidentiality and Integrity | Conceal or Randomize Communications
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(5) > Discussion

SC-8(5) Protected Distribution System - Discussion
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

The purpose of a protected distribution system is to deter, detect, and/or make difficult physical access to the communication lines that carry national security information.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-8 > SC-8(5)

SC-8(5) Transmission Confidentiality and Integrity | Protected Distribution System
Family: System and Communications Protection (SC) > SC-8 Transmission Confidentiality and Integrity

Implement [Assignment: organization-defined protected distribution system] to [Selection; one or more: prevent unauthorized disclosure of information; detect changes to information] during transmission.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-10

SC-10 Network Disconnect
Family: System and Communications Protection (SC)

Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-10 > Discussion

SC-10 Network Disconnect - Discussion
Family: System and Communications Protection (SC)

Network disconnect applies to internal and external networks. Terminating network connections associated with specific communications sessions includes de-allocating TCP/IP address or port pairs at the operating system level and de-allocating the networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. Periods of inactivity may be established by organizations and include time periods by type of network access or for specific network accesses.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-11

SC-11 Trusted Path
Family: System and Communications Protection (SC)

a. Provide a [Selection: physically; logically] isolated trusted communications path for communications between the user and the trusted components of the system; and
b. Permit users to invoke the trusted communications path for communications between the user and the following security functions of the system, including at a minimum, authentication and re-authentication: [Assignment: organization-defined security functions].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-11 > Discussion

SC-11 Trusted Path - Discussion
Family: System and Communications Protection (SC)

Trusted paths are mechanisms by which users can communicate (using input devices such as keyboards) directly with the security functions of systems with the requisite assurance to support security policies. Trusted path mechanisms can only be activated by users or the security functions of organizational systems. User responses that occur via trusted paths are protected from modification by and disclosure to untrusted applications. Organizations employ trusted paths for trustworthy, high-assurance connections between security functions of systems and users, including during system logons. The original implementations of trusted paths employed an out-of-band signal to initiate the path, such as using the <BREAK> key, which does not transmit characters that can be spoofed. In later implementations, a key combination that could not be hijacked was used (e.g., the <CTRL> + <ALT> + <DEL> keys). Such key combinations, however, are platform-specific and may not provide a trusted path implementation in every case. The enforcement of trusted communications paths is provided by a specific implementation that meets the reference monitor concept.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-11 > SC-11(1) > Discussion

SC-11(1) Irrefutable Communications Path - Discussion
Family: System and Communications Protection (SC) > SC-11 Trusted Path

An irrefutable communications path permits the system to initiate a trusted path, which necessitates that the user can unmistakably recognize the source of the communication as a trusted system component. For example, the trusted path may appear in an area of the display that other applications cannot access or be based on the presence of an identifier that cannot be spoofed.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-11 > SC-11(1)

SC-11(1) Trusted Path | Irrefutable Communications Path
Family: System and Communications Protection (SC) > SC-11 Trusted Path

(a) Provide a trusted communications path that is irrefutably distinguishable from other communications paths; and
(b) Initiate the trusted communications path for communications between the [Assignment: organization-defined security functions] of the system and the user.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12

SC-12 Cryptographic Key Establishment and Management
Family: System and Communications Protection (SC)

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > Discussion

SC-12 Cryptographic Key Establishment and Management - Discussion
Family: System and Communications Protection (SC)

Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) and [NIST CAVP](#84dc1b0c-acb7-4269-84c4-00dbabacd78c) provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(1) > Discussion

SC-12(1) Availability - Discussion
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

Escrowing of encryption keys is a common practice for ensuring availability in the event of key loss. A forgotten passphrase is an example of losing a cryptographic key.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(1)

SC-12(1) Cryptographic Key Establishment and Management | Availability
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

Maintain availability of information in the event of the loss of cryptographic keys by users.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(2) > Discussion

SC-12(2) Symmetric Keys - Discussion
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

[SP 800-56A](#20957dbb-6a1e-40a2-b38a-66f67d33ac2e), [SP 800-56B](#0d083d8a-5cc6-46f1-8d79-3081d42bcb75) , and [SP 800-56C](#eef62b16-c796-4554-955c-505824135b8a) provide guidance on cryptographic key establishment schemes and key derivation methods. [SP 800-57-1](#110e26af-4765-49e1-8740-6750f83fcda1), [SP 800-57-2](#e7942589-e267-4a5a-a3d9-f39a7aae81f0) , and [SP 800-57-3](#8306620b-1920-4d73-8b21-12008528595f) provide guidance on cryptographic key management.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(2)

SC-12(2) Cryptographic Key Establishment and Management | Symmetric Keys
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

Produce, control, and distribute symmetric cryptographic keys using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(3) > Discussion

SC-12(3) Asymmetric Keys - Discussion
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

[SP 800-56A](#20957dbb-6a1e-40a2-b38a-66f67d33ac2e), [SP 800-56B](#0d083d8a-5cc6-46f1-8d79-3081d42bcb75) , and [SP 800-56C](#eef62b16-c796-4554-955c-505824135b8a) provide guidance on cryptographic key establishment schemes and key derivation methods. [SP 800-57-1](#110e26af-4765-49e1-8740-6750f83fcda1), [SP 800-57-2](#e7942589-e267-4a5a-a3d9-f39a7aae81f0) , and [SP 800-57-3](#8306620b-1920-4d73-8b21-12008528595f) provide guidance on cryptographic key management.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(3)

SC-12(3) Cryptographic Key Establishment and Management | Asymmetric Keys
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

Produce, control, and distribute asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; certificates issued in accordance with organization-defined requirements].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(6) > Discussion

SC-12(6) Physical Control of Keys - Discussion
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

For organizations that use external service providers (e.g., cloud service or data center providers), physical control of cryptographic keys provides additional assurance that information stored by such external providers is not subject to unauthorized disclosure or modification.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-12 > SC-12(6)

SC-12(6) Cryptographic Key Establishment and Management | Physical Control of Keys
Family: System and Communications Protection (SC) > SC-12 Cryptographic Key Establishment and Management

Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-13

SC-13 Cryptographic Protection
Family: System and Communications Protection (SC)

a. Determine the [Assignment: organization-defined cryptographic uses] ; and
b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-defined types of cryptography].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-13 > Discussion

SC-13 Cryptographic Protection - Discussion
Family: System and Communications Protection (SC)

Cryptography can be employed to support a variety of security solutions, including the protection of classified information and controlled unclassified information, the provision and implementation of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances but lack the necessary formal access approvals. Cryptography can also be used to support random number and hash generation. Generally applicable cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography. For example, organizations that need to protect classified information may specify the use of NSA-approved cryptography. Organizations that need to provision and implement digital signatures may specify the use of FIPS-validated cryptography. Cryptography is implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15

SC-15 Collaborative Computing Devices and Applications
Family: System and Communications Protection (SC)

a. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed] ; and
b. Provide an explicit indication of use to users physically present at the devices.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-15 > Discussion

SC-15 Collaborative Computing Devices and Applications - Discussion
Family: System and Communications Protection (SC)

Collaborative computing devices and applications include remote meeting devices and applications, networked white boards, cameras, and microphones. The explicit indication of use includes signals to users when collaborative computing devices and applications are activated.