ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(3) > Assessment Methods

AC-17(3) Managed Access Control Points - Assessment Methods and Objects

Examine: Access control policy

procedures addressing remote access to the system

system design documentation

list of all managed network access control points

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms routing all remote accesses through managed network access control points
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(3) > Assessment Objective

AC-17(3) Managed Access Control Points - Assessment Objective
Determine if the following are satisfied:

remote accesses are routed through authorized and managed network access control points.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(4) > Assessment Methods

AC-17(4) Privileged Commands and Access - Assessment Methods and Objects

Examine: Access control policy

procedures addressing remote access to the system

system configuration settings and associated documentation

security plan

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing remote access management
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(4) > Assessment Objective

AC-17(4) Privileged Commands and Access - Assessment Objective
Determine if the following are satisfied:

AC-17(04)(a)[01] the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence;
AC-17(04)(a)[02] access to security-relevant information via remote access is authorized only in a format that provides assessable evidence;
AC-17(04)(a)[03] the execution of privileged commands via remote access is authorized only for the following needs: [Assignment: organization-defined needs requiring remote access];
AC-17(04)(a)[04] access to security-relevant information via remote access is authorized only for the following needs: [Assignment: organization-defined needs requiring remote access];
AC-17(04)(b) the rationale for remote access is documented in the security plan for the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(6) > Assessment Methods

AC-17(6) Protection of Mechanism Information - Assessment Methods and Objects

Examine: Access control policy

procedures addressing remote access to the system

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for implementing or monitoring remote access to the system

system users with knowledge of information about remote access mechanisms

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(6) > Assessment Objective

AC-17(6) Protection of Mechanism Information - Assessment Objective
Determine if the following are satisfied:

information about remote access mechanisms is protected from unauthorized use and disclosure.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(9) > Assessment Methods

AC-17(9) Disconnect or Disable Access - Assessment Methods and Objects

Examine: Access control policy

procedures addressing disconnecting or disabling remote access to the system

system design documentation

system configuration settings and associated documentation

security plan, system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing capability to disconnect or disable remote access to system
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(9) > Assessment Objective

AC-17(9) Disconnect or Disable Access - Assessment Objective
Determine if the following are satisfied:

the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period] is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(10) > Assessment Methods

AC-17(10) Authenticate Remote Commands - Assessment Methods and Objects

Examine: Access control policy

procedures addressing authentication of remote commands

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing authentication of remote commands
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-17 > AC-17(10) > Assessment Objective

AC-17(10) Authenticate Remote Commands - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined mechanisms] are implemented to authenticate [Assignment: organization-defined remote commands].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > Assessment Methods

AC-18 Wireless Access - Assessment Methods and Objects

Examine: Access control policy

procedures addressing wireless access implementation and usage (including restrictions)

configuration management plan

system design documentation

system configuration settings and associated documentation

wireless access authorizations

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing wireless access connections

organizational personnel with information security responsibilities

Test: Wireless access management capability for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > Assessment Objective

AC-18 Wireless Access - Assessment Objective
Determine if the following are satisfied:

AC-18a.[01] configuration requirements are established for each type of wireless access;
AC-18a.[02] connection requirements are established for each type of wireless access;
AC-18a.[03] implementation guidance is established for each type of wireless access;
AC-18b. each type of wireless access to the system is authorized prior to allowing such connections.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(1) > Assessment Methods

AC-18(1) Authentication and Encryption - Assessment Methods and Objects

Examine: Access control policy

procedures addressing wireless implementation and usage (including restrictions)

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing wireless access protections to the system
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(1) > Assessment Objective

AC-18(1) Authentication and Encryption - Assessment Objective
Determine if the following are satisfied:

AC-18(01)[01] wireless access to the system is protected using authentication of [Selection; one or more: users; devices];
AC-18(01)[02] wireless access to the system is protected using encryption.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(3) > Assessment Methods

AC-18(3) Disable Wireless Networking - Assessment Methods and Objects

Examine: Access control policy

procedures addressing wireless implementation and usage (including restrictions)

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms managing the disabling of wireless networking capabilities internally embedded within system components
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(3) > Assessment Objective

AC-18(3) Disable Wireless Networking - Assessment Objective
Determine if the following are satisfied:

when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(4) > Assessment Methods

AC-18(4) Restrict Configurations by Users - Assessment Methods and Objects

Examine: Access control policy

procedures addressing wireless implementation and usage (including restrictions)

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms authorizing independent user configuration of wireless networking capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(4) > Assessment Objective

AC-18(4) Restrict Configurations by Users - Assessment Objective
Determine if the following are satisfied:

AC-18(04)[01] users allowed to independently configure wireless networking capabilities are identified;
AC-18(04)[02] users allowed to independently configure wireless networking capabilities are explicitly authorized.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(5) > Assessment Methods

AC-18(5) Antennas and Transmission Power Levels - Assessment Methods and Objects

Examine: Access control policy

procedures addressing wireless implementation and usage (including restrictions)

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Calibration of transmission power levels for wireless access

radio antenna signals for wireless access

wireless access reception outside of organization-controlled boundaries
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-18 > AC-18(5) > Assessment Objective

AC-18(5) Antennas and Transmission Power Levels - Assessment Objective
Determine if the following are satisfied:

AC-18(05)[01] radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries;
AC-18(05)[02] transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-19 > Assessment Methods

AC-19 Access Control for Mobile Devices - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access control for mobile device usage (including restrictions)

configuration management plan

system design documentation

system configuration settings and associated documentation

authorizations for mobile device connections to organizational systems

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel using mobile devices to access organizational systems

system/network administrators

organizational personnel with information security responsibilities

Test: Access control capability for mobile device connections to organizational systems

configurations of mobile devices
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-19 > Assessment Objective

AC-19 Access Control for Mobile Devices - Assessment Objective
Determine if the following are satisfied:

AC-19a.[01] configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
AC-19a.[02] connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
AC-19a.[03] implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
AC-19b. the connection of mobile devices to organizational systems is authorized.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-19 > AC-19(4) > Assessment Methods

AC-19(4) Restrictions for Classified Information - Assessment Methods and Objects

Examine: Access control policy

incident handling policy

procedures addressing access control for mobile devices

system design documentation

system configuration settings and associated documentation

evidentiary documentation for random inspections and reviews of mobile devices

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for random reviews/inspections of mobile devices

organizational personnel using mobile devices in facilities containing systems processing, storing, or transmitting classified information

organizational personnel with incident response responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms prohibiting the use of internal or external modems or wireless interfaces with mobile devices
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-19 > AC-19(4) > Assessment Objective

AC-19(4) Restrictions for Classified Information - Assessment Objective
Determine if the following are satisfied:

AC-19(04)(a) the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official;
AC-19(04)(b)(01) prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
AC-19(04)(b)(02) approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
AC-19(04)(b)(03) prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
AC-19(04)(b)(04)[01] random review and inspection of unclassified mobile devices and the information stored on those devices by [Assignment: organization-defined security officials] are enforced;
AC-19(04)(b)(04)[02] following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices;
AC-19(04)(c) the connection of classified mobile devices to classified systems is restricted in accordance with [Assignment: organization-defined security policies].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-19 > AC-19(5) > Assessment Methods

AC-19(5) Full Device or Container-based Encryption - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access control for mobile devices

system design documentation

system configuration settings and associated documentation

encryption mechanisms and associated configuration documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access control responsibilities for mobile devices

system/network administrators

organizational personnel with information security responsibilities

Test: Encryption mechanisms protecting confidentiality and integrity of information on mobile devices
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-19 > AC-19(5) > Assessment Objective

AC-19(5) Full Device or Container-based Encryption - Assessment Objective
Determine if the following are satisfied:

[Selection: full-device encryption; container-based encryption] is employed to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > Assessment Methods

AC-20 Use of External Systems - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the use of external systems

external systems terms and conditions

list of types of applications accessible from external systems

maximum security categorization for information processed, stored, or transmitted on external systems

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing terms and conditions on the use of external systems
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > Assessment Objective

AC-20 Use of External Systems - Assessment Objective
Determine if the following are satisfied:

AC-20a.01 [Selection; one or more: establish [Assignment: organization-defined terms and conditions] ; identify [Assignment: organization-defined controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);
AC-20a.02 [Selection; one or more: establish [Assignment: organization-defined terms and conditions] ; identify [Assignment: organization-defined controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable);
AC-20b. the use of [Assignment: organization-defined prohibited types of external systems] is prohibited (if applicable).
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(1) > Assessment Methods

AC-20(1) Limits on Authorized Use - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the use of external systems

system connection or processing agreements

account management documents

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing limits on use of external systems
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(1) > Assessment Objective

AC-20(1) Limits on Authorized Use - Assessment Objective
Determine if the following are satisfied:

AC-20(01)(a) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's security and privacy policies and security and privacy plans (if applicable);
AC-20(01)(b) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable).
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(2) > Assessment Methods

AC-20(2) Portable Storage Devices - Restricted Use - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the use of external systems

system configuration settings and associated documentation

system connection or processing agreements

account management documents

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing restrictions on the use of portable storage devices
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(2) > Assessment Objective

AC-20(2) Portable Storage Devices - Restricted Use - Assessment Objective
Determine if the following are satisfied:

the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [Assignment: organization-defined restrictions].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(3) > Assessment Methods

AC-20(3) Non-organizationally Owned Systems - Restricted Use - Assessment Methods and Objects

Examine: Access control policy

procedures addressing the use of external systems

system design documentation

system configuration settings and associated documentation

system connection or processing agreements

account management documents

system audit records, other relevant documents or records

Interview: Organizational personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(3) > Assessment Objective

AC-20(3) Non-organizationally Owned Systems - Restricted Use - Assessment Objective
Determine if the following are satisfied:

the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [Assignment: organization-defined restrictions].