ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > Assessment Methods

SC-28 Protection of Information at Rest - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the protection of information at rest

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated configuration documentation

list of information at rest requiring confidentiality and integrity protections

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing confidentiality and integrity protections for information at rest
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > Assessment Objective

SC-28 Protection of Information at Rest - Assessment Objective
Determine if the following are satisfied:

the [Selection; one or more: confidentiality; integrity] of [Assignment: organization-defined information at rest] is/are protected.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > SC-28(1) > Assessment Methods

SC-28(1) Cryptographic Protection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the protection of information at rest

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated configuration documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Cryptographic mechanisms implementing confidentiality and integrity protections for information at rest
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > SC-28(1) > Assessment Objective

SC-28(1) Cryptographic Protection - Assessment Objective
Determine if the following are satisfied:

SC-28(01)[01] cryptographic mechanisms are implemented to prevent unauthorized disclosure of [Assignment: organization-defined information] at rest on [Assignment: organization-defined system components or media];
SC-28(01)[02] cryptographic mechanisms are implemented to prevent unauthorized modification of [Assignment: organization-defined information] at rest on [Assignment: organization-defined system components or media].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > SC-28(2) > Assessment Methods

SC-28(2) Offline Storage - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the protection of information at rest

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated configuration documentation

offline storage locations for information at rest

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the removal of information from online storage

mechanisms supporting and/or implementing storage of information offline
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > SC-28(2) > Assessment Objective

SC-28(2) Offline Storage - Assessment Objective
Determine if the following are satisfied:

SC-28(02)[01] [Assignment: organization-defined information] is removed from online storage;
SC-28(02)[02] [Assignment: organization-defined information] is stored offline in a secure location.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > SC-28(3) > Assessment Methods

SC-28(3) Cryptographic Keys - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the protection of information at rest

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated configuration documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing hardware-based key store protection
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-28 > SC-28(3) > Assessment Objective

SC-28(3) Cryptographic Keys - Assessment Objective
Determine if the following are satisfied:

protected storage for cryptographic keys is provided using [Selection: [Assignment: organization-defined safeguards] ; hardware-protected key store].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-29 > Assessment Methods

SC-29 Heterogeneity - Assessment Methods and Objects

Examine: System and communications protection policy

system design documentation

system configuration settings and associated documentation

list of technologies deployed in the system

acquisition documentation

acquisition contracts for system components or services

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with system acquisition, development, and implementation responsibilities

Test: Mechanisms supporting and/or implementing the employment of a diverse set of information technologies
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-29 > Assessment Objective

SC-29 Heterogeneity - Assessment Objective
Determine if the following are satisfied:

a diverse set of information technologies is employed for [Assignment: organization-defined system components] in the implementation of the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-29 > SC-29(1) > Assessment Methods

SC-29(1) Virtualization Techniques - Assessment Methods and Objects

Examine: System and communications protection policy

configuration management policy and procedures

system design documentation

system configuration settings and associated documentation

system architecture

list of operating systems and applications deployed using virtualization techniques

change control records

configuration management records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for implementing approved virtualization techniques to the system

Test: Mechanisms supporting and/or implementing the employment of a diverse set of information technologies

mechanisms supporting and/or implementing virtualization techniques
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-29 > SC-29(1) > Assessment Objective

SC-29(1) Virtualization Techniques - Assessment Objective
Determine if the following are satisfied:

virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > Assessment Methods

SC-30 Concealment and Misdirection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing concealment and misdirection techniques for the system

system design documentation

system configuration settings and associated documentation

system architecture

list of concealment and misdirection techniques to be employed for organizational systems

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with the responsibility to implement concealment and misdirection techniques for systems

Test: Mechanisms supporting and/or implementing concealment and misdirection techniques
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > Assessment Objective

SC-30 Concealment and Misdirection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined concealment and misdirection techniques] are employed for [Assignment: organization-defined systems] for [Assignment: organization-defined time periods] to confuse and mislead adversaries.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(2) > Assessment Methods

SC-30(2) Randomness - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing concealment and misdirection techniques for the system

system design documentation

system configuration settings and associated documentation

system architecture

list of techniques to be employed to introduce randomness into organizational operations and assets

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with the responsibility to implement concealment and misdirection techniques for systems

Test: Mechanisms supporting and/or implementing randomness as a concealment and misdirection technique
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(2) > Assessment Objective

SC-30(2) Randomness - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined techniques] are employed to introduce randomness into organizational operations and assets.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(3) > Assessment Methods

SC-30(3) Change Processing and Storage Locations - Assessment Methods and Objects

Examine: System and communications protection policy

configuration management policy and procedures

procedures addressing concealment and misdirection techniques for the system

list of processing/storage locations to be changed at organizational time intervals

change control records

configuration management records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with the responsibility to change processing and/or storage locations

Test: Mechanisms supporting and/or implementing changing processing and/or storage locations
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(3) > Assessment Objective

SC-30(3) Change Processing and Storage Locations - Assessment Objective
Determine if the following are satisfied:

the location of [Assignment: organization-defined processing and/or storage] is changed [Selection: [Assignment: organization-defined time frequency] ; random time intervals].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(4) > Assessment Methods

SC-30(4) Misleading Information - Assessment Methods and Objects

Examine: System and communications protection policy

configuration management policy and procedures

procedures addressing concealment and misdirection techniques for the system

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with the responsibility to define and employ realistic but misleading information about the security posture of system components

Test: Mechanisms supporting and/or implementing the employment of realistic but misleading information about the security posture of system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(4) > Assessment Objective

SC-30(4) Misleading Information - Assessment Objective
Determine if the following are satisfied:

realistic but misleading information about the security state or posture of [Assignment: organization-defined system components] is employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(5) > Assessment Methods

SC-30(5) Concealment of System Components - Assessment Methods and Objects

Examine: System and communications protection policy

configuration management policy and procedures

procedures addressing concealment and misdirection techniques for the system

system design documentation

system configuration settings and associated documentation

list of techniques employed to hide or conceal system components

list of system components to be hidden or concealed

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with the responsibility to conceal system components

Test: Mechanisms supporting and/or implementing techniques for the concealment of system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-30 > SC-30(5) > Assessment Objective

SC-30(5) Concealment of System Components - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined techniques] are employed to hide or conceal [Assignment: organization-defined system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > Assessment Methods

SC-31 Covert Channel Analysis - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing covert channel analysis

system design documentation

system configuration settings and associated documentation

covert channel analysis documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with covert channel analysis responsibilities

system developers/integrators

Test: Organizational process for conducting covert channel analysis

mechanisms supporting and/or implementing covert channel analysis

mechanisms supporting and/or implementing the capability to estimate the bandwidth of covert channels
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > Assessment Objective

SC-31 Covert Channel Analysis - Assessment Objective
Determine if the following are satisfied:

SC-31a. a covert channel analysis is performed to identify those aspects of communications within the system that are potential avenues for covert [Selection; one or more: storage; timing] channels;
SC-31b. the maximum bandwidth of those channels is estimated.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > SC-31(1) > Assessment Methods

SC-31(1) Test Covert Channels for Exploitability - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing covert channel analysis

system design documentation

system configuration settings and associated documentation

list of covert channels

covert channel analysis documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with covert channel analysis responsibilities

Test: Organizational process for testing covert channels

mechanisms supporting and/or implementing the testing of covert channel analysis
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > SC-31(1) > Assessment Objective

SC-31(1) Test Covert Channels for Exploitability - Assessment Objective
Determine if the following are satisfied:

a subset of the identified covert channels is tested to determine the channels that are exploitable.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > SC-31(2) > Assessment Methods

SC-31(2) Maximum Bandwidth - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing covert channel analysis

acquisition contracts for systems or services

acquisition documentation

system design documentation

system configuration settings and associated documentation

covert channel analysis documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with covert channel analysis responsibilities

system developers/integrators

Test: Organizational process for conducting covert channel analysis

mechanisms supporting and/or implementing covert channel analysis

mechanisms supporting and/or implementing the capability to reduce the bandwidth of covert channels
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > SC-31(2) > Assessment Objective

SC-31(2) Maximum Bandwidth - Assessment Objective
Determine if the following are satisfied:

the maximum bandwidth for identified covert [Selection; one or more: storage; timing] channels is reduced to [Assignment: organization-defined values].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > SC-31(3) > Assessment Methods

SC-31(3) Measure Bandwidth in Operational Environments - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing covert channel analysis

system design documentation

system configuration settings and associated documentation

covert channel analysis documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with covert channel analysis responsibilities

system developers/integrators

Test: Organizational process for conducting covert channel analysis

mechanisms supporting and/or implementing covert channel analysis

mechanisms supporting and/or implementing the capability to measure the bandwidth of covert channels
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-31 > SC-31(3) > Assessment Objective

SC-31(3) Measure Bandwidth in Operational Environments - Assessment Objective
Determine if the following are satisfied:

the bandwidth of [Assignment: organization-defined subset of identified covert channels] is measured in the operational environment of the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-32 > Assessment Methods

SC-32 System Partitioning - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing system partitioning

system design documentation

system configuration settings and associated documentation

system architecture

list of system physical domains (or environments)

system facility diagrams

system network diagrams

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Mechanisms supporting and/or implementing the physical separation of system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-32 > Assessment Objective

SC-32 System Partitioning - Assessment Objective
Determine if the following are satisfied:

the system is partitioned into [Assignment: organization-defined system components] residing in separate [Selection: physical; logical] domains or environments based on [Assignment: organization-defined circumstances for the physical or logical separation of components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-32 > SC-32(1) > Assessment Methods

SC-32(1) Separate Physical Domains for Privileged Functions - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing system partitioning

system design documentation

system configuration settings and associated documentation

system architecture

list of system physical domains (or environments)

system facility diagrams

system network diagrams

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Mechanisms supporting and/or implementing the physical separation of system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-32 > SC-32(1) > Assessment Objective

SC-32(1) Separate Physical Domains for Privileged Functions - Assessment Objective
Determine if the following are satisfied:

privileged functions are partitioned into separate physical domains.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-34 > Assessment Methods

SC-34 Non-modifiable Executable Programs - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing non-modifiable executable programs

system design documentation

system configuration settings and associated documentation

system architecture

list of operating system components to be loaded from hardware-enforced, read-only media

list of applications to be loaded from hardware-enforced, read-only media

media used to load and execute the system operating environment

media used to load and execute system applications

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Mechanisms supporting and/or implementing, loading, and executing the operating environment from hardware-enforced, read-only media

mechanisms supporting and/or implementing, loading, and executing applications from hardware-enforced, read-only media
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-34 > Assessment Objective

SC-34 Non-modifiable Executable Programs - Assessment Objective
Determine if the following are satisfied:

SC-34a. the operating environment for [Assignment: organization-defined system components] is loaded and executed from hardware-enforced, read-only media;
SC-34b. [Assignment: organization-defined applications] for [Assignment: organization-defined system components] are loaded and executed from hardware-enforced, read-only media.