ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
AT > AT-4

AT-4 Training Records
Family: Awareness and Training (AT)

a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and
b. Retain individual training records for [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
AT > AT-4 > Discussion

AT-4 Training Records - Discussion
Family: Awareness and Training (AT)

Documentation for specialized training may be maintained by individual supervisors at the discretion of the organization. The National Archives and Records Administration provides guidance on records retention for federal agencies.
Security and Privacy Controls for Information Systems and Organizations
AT > AT-6

AT-6 Training Feedback
Family: Awareness and Training (AT)

Provide feedback on organizational training results to the following personnel [Assignment: organization-defined frequency]: [Assignment: organization-defined personnel].
Security and Privacy Controls for Information Systems and Organizations
AT > AT-6 > Discussion

AT-6 Training Feedback - Discussion
Family: Awareness and Training (AT)

Training feedback includes awareness training results and role-based training results. Training results, especially failures of personnel in critical roles, can be indicative of a potentially serious problem. Therefore, it is important that senior managers are made aware of such situations so that they can take appropriate response actions. Training feedback supports the evaluation and update of organizational training described in [AT-2b](#at-2_smt.b) and [AT-3b](#at-3_smt.b).
Security and Privacy Controls for Information Systems and Organizations
AU > AU-1

AU-1 Policy and Procedures
Family: Audit and Accountability (AU)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] audit and accountability policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and
c. Review and update the current audit and accountability:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-1 > Discussion

AU-1 Policy and Procedures - Discussion
Family: Audit and Accountability (AU)

Audit and accountability policy and procedures address the controls in the AU family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of audit and accountability policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to audit and accountability policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-2

AU-2 Event Logging
Family: Audit and Accountability (AU)

a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types];
b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
c. Specify the following event types for logging within the system: [Assignment: organization-defined organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type];
d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
e. Review and update the event types selected for logging [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-2 > Discussion

AU-2 Event Logging - Discussion
Family: Audit and Accountability (AU)

An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system.

To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage.

Event logging requirements, including the need to log specific event types, may be referenced in other controls and control enhancements. These include [AC-2(4)](#ac-2.4), [AC-3(10)](#ac-3.10), [AC-6(9)](#ac-6.9), [AC-17(1)](#ac-17.1), [CM-3f](#cm-3_smt.f), [CM-5(1)](#cm-5.1), [IA-3(3)(b)](#ia-3.3_smt.b), [MA-4(1)](#ma-4.1), [MP-4(2)](#mp-4.2), [PE-3](#pe-3), [PM-21](#pm-21), [PT-7](#pt-7), [RA-8](#ra-8), [SC-7(9)](#sc-7.9), [SC-7(15)](#sc-7.15), [SI-3(8)](#si-3.8), [SI-4(22)](#si-4.22), [SI-7(8)](#si-7.8) , and [SI-10(1)](#si-10.1) . Organizations include event types that are required by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. Audit records can be generated at various levels, including at the packet level as information traverses the network. Selecting the appropriate level of event logging is an important part of a monitoring and auditing capability and can identify the root causes of problems. When defining event types, organizations consider the logging necessary to cover related event types, such as the steps in distributed, transaction-based processes and the actions that occur in service-oriented architectures.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-3

AU-3 Content of Audit Records
Family: Audit and Accountability (AU)

Ensure that audit records contain information that establishes the following:
a. What type of event occurred;
b. When the event occurred;
c. Where the event occurred;
d. Source of the event;
e. Outcome of the event; and
f. Identity of any individuals, subjects, or objects/entities associated with the event.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-3 > Discussion

AU-3 Content of Audit Records - Discussion
Family: Audit and Accountability (AU)

Audit record content that may be necessary to support the auditing function includes event descriptions (item a), time stamps (item b), source and destination addresses (item c), user or process identifiers (items d and f), success or fail indications (item e), and filenames involved (items a, c, e, and f) . Event outcomes include indicators of event success or failure and event-specific results, such as the system security and privacy posture after the event occurred. Organizations consider how audit records can reveal information about individuals that may give rise to privacy risks and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the trail records inputs or is based on patterns or time of usage.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-3 > AU-3(1) > Discussion

AU-3(1) Additional Audit Information - Discussion
Family: Audit and Accountability (AU) > AU-3 Content of Audit Records

The ability to add information generated in audit records is dependent on system functionality to configure the audit record content. Organizations may consider additional information in audit records including, but not limited to, access control or flow control rules invoked and individual identities of group account users. Organizations may also consider limiting additional audit record information to only information that is explicitly needed for audit requirements. This facilitates the use of audit trails and audit logs by not including information in audit records that could potentially be misleading, make it more difficult to locate information of interest, or increase the risk to individuals' privacy.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-3 > AU-3(1)

AU-3(1) Content of Audit Records | Additional Audit Information
Family: Audit and Accountability (AU) > AU-3 Content of Audit Records

Generate audit records containing the following additional information: [Assignment: organization-defined additional information].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-3 > AU-3(3) > Discussion

AU-3(3) Limit Personally Identifiable Information Elements - Discussion
Family: Audit and Accountability (AU) > AU-3 Content of Audit Records

Limiting personally identifiable information in audit records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-3 > AU-3(3)

AU-3(3) Content of Audit Records | Limit Personally Identifiable Information Elements
Family: Audit and Accountability (AU) > AU-3 Content of Audit Records

Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-4

AU-4 Audit Log Storage Capacity
Family: Audit and Accountability (AU)

Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-4 > Discussion

AU-4 Audit Log Storage Capacity - Discussion
Family: Audit and Accountability (AU)

Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-4 > AU-4(1) > Discussion

AU-4(1) Transfer to Alternate Storage - Discussion
Family: Audit and Accountability (AU) > AU-4 Audit Log Storage Capacity

Audit log transfer, also known as off-loading, is a common process in systems with limited audit log storage capacity and thus supports availability of the audit logs. The initial audit log storage is only used in a transitory fashion until the system can communicate with the secondary or alternate system allocated to audit log storage, at which point the audit logs are transferred. Transferring audit logs to alternate storage is similar to [AU-9(2)](#au-9.2) in that audit logs are transferred to a different entity. However, the purpose of selecting [AU-9(2)](#au-9.2) is to protect the confidentiality and integrity of audit records. Organizations can select either control enhancement to obtain the benefit of increased audit log storage capacity and preserving the confidentiality, integrity, and availability of audit records and logs.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-4 > AU-4(1)

AU-4(1) Audit Log Storage Capacity | Transfer to Alternate Storage
Family: Audit and Accountability (AU) > AU-4 Audit Log Storage Capacity

Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5

AU-5 Response to Audit Logging Process Failures
Family: Audit and Accountability (AU)

a. Alert [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] in the event of an audit logging process failure; and
b. Take the following additional actions: [Assignment: organization-defined additional actions].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > Discussion

AU-5 Response to Audit Logging Process Failures - Discussion
Family: Audit and Accountability (AU)

Audit logging process failures include software and hardware errors, failures in audit log capturing mechanisms, and reaching or exceeding audit log storage capacity. Organization-defined actions include overwriting oldest audit records, shutting down the system, and stopping the generation of audit records. Organizations may choose to define additional actions for audit logging process failures based on the type of failure, the location of the failure, the severity of the failure, or a combination of such factors. When the audit logging process failure is related to storage, the response is carried out for the audit log storage repository (i.e., the distinct system component where the audit logs are stored), the system on which the audit logs reside, the total audit log storage capacity of the organization (i.e., all audit log storage repositories combined), or all three. Organizations may decide to take no additional actions after alerting designated roles or personnel.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(1) > Discussion

AU-5(1) Storage Capacity Warning - Discussion
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Organizations may have multiple audit log storage repositories distributed across multiple system components with each repository having different storage volume capacities.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(1)

AU-5(1) Response to Audit Logging Process Failures | Storage Capacity Warning
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Provide a warning to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit log storage volume reaches [Assignment: organization-defined percentage] of repository maximum audit log storage capacity.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(2) > Discussion

AU-5(2) Real-time Alerts - Discussion
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less).
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(2)

AU-5(2) Response to Audit Logging Process Failures | Real-time Alerts
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit logging failure events requiring real-time alerts].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(3) > Discussion

AU-5(3) Configurable Traffic Volume Thresholds - Discussion
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Organizations have the capability to reject or delay the processing of network communications traffic if audit logging information about such traffic is determined to exceed the storage capacity of the system audit logging function. The rejection or delay response is triggered by the established organizational traffic volume thresholds that can be adjusted based on changes to audit log storage capacity.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(3)

AU-5(3) Response to Audit Logging Process Failures | Configurable Traffic Volume Thresholds
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection; one or more: reject; delay] network traffic above those thresholds.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(4) > Discussion

AU-5(4) Shutdown on Failure - Discussion
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Organizations determine the types of audit logging failures that can trigger automatic system shutdowns or degraded operations. Because of the importance of ensuring mission and business continuity, organizations may determine that the nature of the audit logging failure is not so severe that it warrants a complete shutdown of the system supporting the core organizational mission and business functions. In those instances, partial system shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(4)

AU-5(4) Response to Audit Logging Process Failures | Shutdown on Failure
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Invoke a [Selection; one or more: full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: organization-defined audit logging failures] , unless an alternate audit logging capability exists.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(5) > Discussion

AU-5(5) Alternate Audit Logging Capability - Discussion
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Since an alternate audit logging capability may be a short-term protection solution employed until the failure in the primary audit logging capability is corrected, organizations may determine that the alternate audit logging capability need only provide a subset of the primary audit logging functionality that is impacted by the failure.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-5 > AU-5(5)

AU-5(5) Response to Audit Logging Process Failures | Alternate Audit Logging Capability
Family: Audit and Accountability (AU) > AU-5 Response to Audit Logging Process Failures

Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [Assignment: organization-defined alternate audit logging functionality].
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6

AU-6 Audit Record Review, Analysis, and Reporting
Family: Audit and Accountability (AU)

a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
b. Report findings to [Assignment: organization-defined personnel or roles] ; and
c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > Discussion

AU-6 Audit Record Review, Analysis, and Reporting - Discussion
Family: Audit and Accountability (AU)

Audit record review, analysis, and reporting covers information security- and privacy-related logging performed by organizations, including logging that results from the monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and non-local maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at system interfaces, and use of mobile code or Voice over Internet Protocol (VoIP). Findings can be reported to organizational entities that include the incident response team, help desk, and security or privacy offices. If organizations are prohibited from reviewing and analyzing audit records or unable to conduct such activities, the review or analysis may be carried out by other organizations granted such authority. The frequency, scope, and/or depth of the audit record review, analysis, and reporting may be adjusted to meet organizational needs based on new information received.
Security and Privacy Controls for Information Systems and Organizations
AU > AU-6 > AU-6(1) > Discussion

AU-6(1) Automated Process Integration - Discussion
Family: Audit and Accountability (AU) > AU-6 Audit Record Review, Analysis, and Reporting

Organizational processes that benefit from integrated audit record review, analysis, and reporting include incident response, continuous monitoring, contingency planning, investigation and response to suspicious activities, and Inspector General audits.