ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(2) > Assessment Objective

SA-9(2) Identification of Functions, Ports, Protocols, and Services - Assessment Objective
Determine if the following are satisfied:

providers of [Assignment: organization-defined external system services] are required to identify the functions, ports, protocols, and other services required for the use of such services.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(3) > Assessment Methods

SA-9(3) Establish and Maintain Trust Relationship with Providers - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

acquisition contracts for the system, system component, or system service

acquisition documentation

solicitation documentation

service level agreements

memorandum of understanding

memorandum of agreements

list of organizational security and privacy requirements, properties, factors, or conditions for external provider services

documentation of trust relationships with external service providers

system security plan

privacy plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

external providers of system services

organizational personnel with supply chain risk management responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(3) > Assessment Objective

SA-9(3) Establish and Maintain Trust Relationship with Providers - Assessment Objective
Determine if the following are satisfied:

SA-09(03)[01] trust relationships with external service provides based on [Assignment: organization-defined security requirements, properties, factors, or conditions] are established and documented;
SA-09(03)[02] trust relationships with external service provides based on [Assignment: organization-defined security requirements, properties, factors, or conditions] are maintained;
SA-09(03)[03] trust relationships with external service provides based on [Assignment: organization-defined privacy requirements, properties, factors, or conditions] are established and documented;
SA-09(03)[04] trust relationships with external service provides based on [Assignment: organization-defined privacy requirements, properties, factors, or conditions] are maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(4) > Assessment Methods

SA-9(4) Consistent Interests of Consumers and Providers - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing external system services

acquisition contracts for the system, system component, or system service

solicitation documentation

acquisition documentation

service level agreements

organizational security requirements/safeguards for external service providers

personnel security policies for external service providers

assessments performed on external service providers

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

external providers of system services

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining and employing safeguards to ensure consistent interests with external service providers

mechanisms supporting and/or implementing safeguards to ensure consistent interests with external service providers
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(4) > Assessment Objective

SA-9(4) Consistent Interests of Consumers and Providers - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined actions] are taken to verify that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(5) > Assessment Methods

SA-9(5) Processing, Storage, and Service Location - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing external system services

acquisition contracts for the system, system component, or system service

solicitation documentation

acquisition documentation

service level agreements

restricted locations for information processing

information/data and/or system services

information processing, information/data, and/or system services to be maintained in restricted locations

organizational security requirements or conditions for external providers

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

external providers of system services

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for defining the requirements to restrict locations of information processing, information/data, or information services

organizational processes for ensuring the location is restricted in accordance with requirements or conditions
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(5) > Assessment Objective

SA-9(5) Processing, Storage, and Service Location - Assessment Objective
Determine if the following are satisfied:

based on [Assignment: organization-defined requirements], [Selection; one or more: information processing; information or data; system services] is/are restricted to [Assignment: organization-defined locations].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(6) > Assessment Methods

SA-9(6) Organization-controlled Cryptographic Keys - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing external system services

acquisition contracts for the system, system component, or system service

solicitation documentation

acquisition documentation

service level agreements

procedures addressing organization-controlled cryptographic key management

organizational security requirements or conditions for external providers

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organization personnel with cryptographic key management responsibilities

external providers of system services

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for cryptographic key management

mechanisms for supporting and implementing the management of organization-controlled cryptographic keys
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(6) > Assessment Objective

SA-9(6) Organization-controlled Cryptographic Keys - Assessment Objective
Determine if the following are satisfied:

exclusive control of cryptographic keys is maintained for encrypted material stored or transmitted through an external system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(7) > Assessment Methods

SA-9(7) Organization-controlled Integrity Checking - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing external system services

acquisition contracts for the system, system component, or system service

solicitation documentation

acquisition documentation

service level agreements

procedures addressing organization-controlled integrity checking

information/data and/or system services

organizational security requirements or conditions for external providers

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organization personnel with integrity checking responsibilities

external providers of system services

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for integrity checking

mechanisms for supporting and implementing integrity checking of information in external systems
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(7) > Assessment Objective

SA-9(7) Organization-controlled Integrity Checking - Assessment Objective
Determine if the following are satisfied:

the capability is provided to check the integrity of information while it resides in the external system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(8) > Assessment Methods

SA-9(8) Processing and Storage Location - U.S. Jurisdiction - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

procedures addressing external system services

acquisition contracts for the system, system component, or system service

solicitation documentation

acquisition documentation

service level agreements

procedures addressing determining jurisdiction restrictions for processing and storage location

information/data and/or system services

organizational security requirements or conditions for external providers

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organization personnel with supply chain risk management responsibilities

external providers of system services

Test: Organizational processes restricting external system service providers to process and store information within the legal jurisdictional boundary of the United States
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-9 > SA-9(8) > Assessment Objective

SA-9(8) Processing and Storage Location - U.S. Jurisdiction - Assessment Objective
Determine if the following are satisfied:

the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > Assessment Methods

SA-10 Developer Configuration Management - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer configuration management

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

security flaw and flaw resolution tracking records

system change authorization records

change control records

configuration management records

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for monitoring developer configuration management

mechanisms supporting and/or implementing the monitoring of developer configuration management
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > Assessment Objective

SA-10 Developer Configuration Management - Assessment Objective
Determine if the following are satisfied:

SA-10a. the developer of the system, system component, or system service is required to perform configuration management during system, component, or service [Selection; one or more: design; development; implementation; operation; disposal];
SA-10b.[01] the developer of the system, system component, or system service is required to document the integrity of changes to [Assignment: organization-defined configuration items];
SA-10b.[02] the developer of the system, system component, or system service is required to manage the integrity of changes to [Assignment: organization-defined configuration items];
SA-10b.[03] the developer of the system, system component, or system service is required to control the integrity of changes to [Assignment: organization-defined configuration items];
SA-10c. the developer of the system, system component, or system service is required to implement only organization-approved changes to the system, component, or service;
SA-10d.[01] the developer of the system, system component, or system service is required to document approved changes to the system, component, or service;
SA-10d.[02] the developer of the system, system component, or system service is required to document the potential security impacts of approved changes;
SA-10d.[03] the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes;
SA-10e.[01] the developer of the system, system component, or system service is required to track security flaws within the system, component, or service;
SA-10e.[02] the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service;
SA-10e.[03] the developer of the system, system component, or system service is required to report findings to [Assignment: organization-defined personnel].
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(1) > Assessment Methods

SA-10(1) Software and Firmware Integrity Verification - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer configuration management

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

software and firmware integrity verification records

system change authorization records

change control records

configuration management records

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with configuration management responsibilities

system developers

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for monitoring developer configuration management

mechanisms supporting and/or implementing the monitoring of developer configuration management
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(1) > Assessment Objective

SA-10(1) Software and Firmware Integrity Verification - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to enable integrity verification of software and firmware components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(2) > Assessment Methods

SA-10(2) Alternative Configuration Management Processes - Assessment Methods and Objects

Examine: System and services acquisition policy

system and services acquisition procedures

configuration management policy

configuration management plan

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

security impact analyses

privacy impact analyses

privacy impact assessment

privacy risk assessment documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for monitoring developer configuration management

mechanisms supporting and/or implementing the monitoring of developer configuration management
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(2) > Assessment Objective

SA-10(2) Alternative Configuration Management Processes - Assessment Objective
Determine if the following are satisfied:

an alternate configuration management process has been provided using organizational personnel in the absence of a dedicated developer configuration management team.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(3) > Assessment Methods

SA-10(3) Hardware Integrity Verification - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer configuration management

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

hardware integrity verification records

system security plan

supply chain risk management plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with configuration management responsibilities

system developers

organizational personnel with supply chain risk management responsibilities

Test: Organizational processes for monitoring developer configuration management

mechanisms supporting and/or implementing the monitoring of developer configuration management
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(3) > Assessment Objective

SA-10(3) Hardware Integrity Verification - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to enable integrity verification of hardware components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(4) > Assessment Methods

SA-10(4) Trusted Generation - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer configuration management

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

change control records

configuration management records

configuration control audit records

system security plan

other relevant documents or records

Test: Organizational processes for monitoring developer configuration management

mechanisms supporting and/or implementing the monitoring of developer configuration management
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(4) > Assessment Objective

SA-10(4) Trusted Generation - Assessment Objective
Determine if the following are satisfied:

SA-10(04)[01] the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions;
SA-10(04)[02] the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions;
SA-10(04)[03] the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(5) > Assessment Methods

SA-10(5) Mapping Integrity for Version Control - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer configuration management

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

change control records

configuration management records

version control change/update records

integrity verification records between master copies of security-relevant hardware, software, and firmware (including designs and source code)

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for monitoring developer configuration management

mechanisms supporting and/or implementing the monitoring of developer configuration management
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(5) > Assessment Objective

SA-10(5) Mapping Integrity for Version Control - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(6) > Assessment Methods

SA-10(6) Trusted Distribution - Assessment Methods and Objects

Examine: System and services acquisition policy

procedures addressing system developer configuration management

solicitation documentation

acquisition documentation

service level agreements

acquisition contracts for the system, system component, or system service

system developer configuration management plan

change control records

configuration management records

system security plan

other relevant documents or records

Interview: Organizational personnel with system and service acquisition responsibilities

organizational personnel with information security responsibilities

organizational personnel with configuration management responsibilities

system developers

Test: Organizational processes for monitoring developer configuration management

mechanisms supporting and/or implementing the monitoring of developer configuration management
Assessing Security and Privacy Controls in Information Systems and Organizations
SA > SA-10 > SA-10(6) > Assessment Objective

SA-10(6) Trusted Distribution - Assessment Objective
Determine if the following are satisfied:

the developer of the system, system component, or system service is required to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.