ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(1) > Discussion

SI-18(1) Automation Support - Discussion
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

The use of automated mechanisms to improve data quality may inadvertently create privacy risks. Automated tools may connect to external or otherwise unrelated systems, and the matching of records between these systems may create linkages with unintended consequences. Organizations assess and document these risks in their privacy impact assessments and make determinations that are in alignment with their privacy program plans.

As data is obtained and used across the information life cycle, it is important to confirm the accuracy and relevance of personally identifiable information. Automated mechanisms can augment existing data quality processes and procedures and enable an organization to better identify and manage personally identifiable information in large-scale systems. For example, automated tools can greatly improve efforts to consistently normalize data or identify malformed data. Automated tools can also be used to improve the auditing of data and detect errors that may incorrectly alter personally identifiable information or incorrectly associate such information with the wrong individual. Automated capabilities backstop processes and procedures at-scale and enable more fine-grained detection and correction of data quality errors.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(1)

SI-18(1) Personally Identifiable Information Quality Operations | Automation Support
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(2) > Discussion

SI-18(2) Data Tags - Discussion
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Data tagging personally identifiable information includes tags that note processing permissions, authority to process, de-identification, impact level, information life cycle stage, and retention or last updated dates. Employing data tags for personally identifiable information can support the use of automation tools to correct or delete relevant personally identifiable information.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(2)

SI-18(2) Personally Identifiable Information Quality Operations | Data Tags
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(3) > Discussion

SI-18(3) Collection - Discussion
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Individuals or their designated representatives can be sources of correct personally identifiable information. Organizations consider contextual factors that may incentivize individuals to provide correct data versus false data. Additional steps may be necessary to validate collected information based on the nature and context of the personally identifiable information, how it is to be used, and how it was obtained. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals under federal programs may be more comprehensive than the measures taken to validate less sensitive personally identifiable information.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(3)

SI-18(3) Personally Identifiable Information Quality Operations | Collection
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Collect personally identifiable information directly from the individual.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(4) > Discussion

SI-18(4) Individual Requests - Discussion
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Inaccurate personally identifiable information maintained by organizations may cause problems for individuals, especially in those business functions where inaccurate information may result in inappropriate decisions or the denial of benefits and services to individuals. Even correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of an organization maintaining the information. Organizations use discretion when determining if personally identifiable information is to be corrected or deleted based on the scope of requests, the changes sought, the impact of the changes, and laws, regulations, and policies. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding appropriate instances of correction or deletion.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(4)

SI-18(4) Personally Identifiable Information Quality Operations | Individual Requests
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Correct or delete personally identifiable information upon request by individuals or their designated representatives.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(5) > Discussion

SI-18(5) Notice of Correction or Deletion - Discussion
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

When personally identifiable information is corrected or deleted, organizations take steps to ensure that all authorized recipients of such information, and the individual with whom the information is associated or their designated representatives, are informed of the corrected or deleted information.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-18 > SI-18(5)

SI-18(5) Personally Identifiable Information Quality Operations | Notice of Correction or Deletion
Family: System and Information Integrity (SI) > SI-18 Personally Identifiable Information Quality Operations

Notify [Assignment: organization-defined recipients] and individuals that the personally identifiable information has been corrected or deleted.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19

SI-19 De-identification
Family: System and Information Integrity (SI)

a. Remove the following elements of personally identifiable information from datasets: [Assignment: organization-defined elements] ; and
b. Evaluate [Assignment: organization-defined frequency] for effectiveness of de-identification.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > Discussion

SI-19 De-identification - Discussion
Family: System and Information Integrity (SI)

De-identification is the general term for the process of removing the association between a set of identifying data and the data subject. Many datasets contain information about individuals that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records. Datasets may also contain other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Personally identifiable information is removed from datasets by trained individuals when such information is not (or no longer) necessary to satisfy the requirements envisioned for the data. For example, if the dataset is only used to produce aggregate statistics, the identifiers that are not needed for producing those statistics are removed. Removing identifiers improves privacy protection since information that is removed cannot be inadvertently disclosed or improperly used. Organizations may be subject to specific de-identification definitions or methods under applicable laws, regulations, or policies. Re-identification is a residual risk with de-identified data. Re-identification attacks can vary, including combining new datasets or other improvements in data analytics. Maintaining awareness of potential attacks and evaluating for the effectiveness of the de-identification over time support the management of this residual risk.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(1) > Discussion

SI-19(1) Collection - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

If a data source contains personally identifiable information but the information will not be used, the dataset can be de-identified when it is created by not collecting the data elements that contain the personally identifiable information. For example, if an organization does not intend to use the social security number of an applicant, then application forms do not ask for a social security number.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(1)

SI-19(1) De-identification | Collection
Family: System and Information Integrity (SI) > SI-19 De-identification

De-identify the dataset upon collection by not collecting personally identifiable information.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(2) > Discussion

SI-19(2) Archiving - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

Datasets can be archived for many reasons. The envisioned purposes for the archived dataset are specified, and if personally identifiable information elements are not required, the elements are not archived. For example, social security numbers may have been collected for record linkage, but the archived dataset may include the required elements from the linked records. In this case, it is not necessary to archive the social security numbers.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(2)

SI-19(2) De-identification | Archiving
Family: System and Information Integrity (SI) > SI-19 De-identification

Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(3) > Discussion

SI-19(3) Release - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

Prior to releasing a dataset, a data custodian considers the intended uses of the dataset and determines if it is necessary to release personally identifiable information. If the personally identifiable information is not necessary, the information can be removed using de-identification techniques.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(3)

SI-19(3) De-identification | Release
Family: System and Information Integrity (SI) > SI-19 De-identification

Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(4) > Discussion

SI-19(4) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

There are many possible processes for removing direct identifiers from a dataset. Columns in a dataset that contain a direct identifier can be removed. In masking, the direct identifier is transformed into a repeating character, such as XXXXXX or 999999. Identifiers can be encrypted or hashed so that the linked records remain linked. In the case of encryption or hashing, algorithms are employed that require the use of a key, including the Advanced Encryption Standard or a Hash-based Message Authentication Code. Implementations may use the same key for all identifiers or use a different key for each identifier. Using a different key for each identifier provides a higher degree of security and privacy. Identifiers can alternatively be replaced with a keyword, including transforming "George Washington" to "PATIENT" or replacing it with a surrogate value, such as transforming "George Washington" to "Abraham Polk."
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(4)

SI-19(4) De-identification | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
Family: System and Information Integrity (SI) > SI-19 De-identification

Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(5) > Discussion

SI-19(5) Statistical Disclosure Control - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

Many types of statistical analyses can result in the disclosure of information about individuals even if only summary information is provided. For example, if a school that publishes a monthly table with the number of minority students enrolled, reports that it has 10-19 such students in January, and subsequently reports that it has 20-29 such students in March, then it can be inferred that the student who enrolled in February was a minority.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(5)

SI-19(5) De-identification | Statistical Disclosure Control
Family: System and Information Integrity (SI) > SI-19 De-identification

Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(6) > Discussion

SI-19(6) Differential Privacy - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

The mathematical definition for differential privacy holds that the result of a dataset analysis should be approximately the same before and after the addition or removal of a single data record (which is assumed to be the data from a single individual). In its most basic form, differential privacy applies only to online query systems. However, it can also be used to produce machine-learning statistical classifiers and synthetic data. Differential privacy comes at the cost of decreased accuracy of results, forcing organizations to quantify the trade-off between privacy protection and the overall accuracy, usefulness, and utility of the de-identified dataset. Non-deterministic noise can include adding small, random values to the results of mathematical operations in dataset analysis.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(6)

SI-19(6) De-identification | Differential Privacy
Family: System and Information Integrity (SI) > SI-19 De-identification

Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(7) > Discussion

SI-19(7) Validated Algorithms and Software - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

Algorithms that appear to remove personally identifiable information from a dataset may in fact leave information that is personally identifiable or data that is re-identifiable. Software that is claimed to implement a validated algorithm may contain bugs or implement a different algorithm. Software may de-identify one type of data, such as integers, but not de-identify another type of data, such as floating point numbers. For these reasons, de-identification is performed using algorithms and software that are validated.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(7)

SI-19(7) De-identification | Validated Algorithms and Software
Family: System and Information Integrity (SI) > SI-19 De-identification

Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(8) > Discussion

SI-19(8) Motivated Intruder - Discussion
Family: System and Information Integrity (SI) > SI-19 De-identification

A motivated intruder test is a test in which an individual or group takes a data release and specified resources and attempts to re-identify one or more individuals in the de-identified dataset. Such tests specify the amount of inside knowledge, computational resources, financial resources, data, and skills that intruders possess to conduct the tests. A motivated intruder test can determine if the de-identification is insufficient. It can also be a useful diagnostic tool to assess if de-identification is likely to be sufficient. However, the test alone cannot prove that de-identification is sufficient.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-19 > SI-19(8)

SI-19(8) De-identification | Motivated Intruder
Family: System and Information Integrity (SI) > SI-19 De-identification

Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-20

SI-20 Tainting
Family: System and Information Integrity (SI)

Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: organization-defined systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-20 > Discussion

SI-20 Tainting - Discussion
Family: System and Information Integrity (SI)

Many cyber-attacks target organizational information, or information that the organization holds on behalf of other entities (e.g., personally identifiable information), and exfiltrate that data. In addition, insider attacks and erroneous user procedures can remove information from the system that is in violation of the organizational policies. Tainting approaches can range from passive to active. A passive tainting approach can be as simple as adding false email names and addresses to an internal database. If the organization receives email at one of the false email addresses, it knows that the database has been compromised. Moreover, the organization knows that the email was sent by an unauthorized entity, so any packets it includes potentially contain malicious code, and that the unauthorized entity may have potentially obtained a copy of the database. Another tainting approach can include embedding false data or steganographic data in files to enable the data to be found via open-source analysis. Finally, an active tainting approach can include embedding software in the data that is able to "call home," thereby alerting the organization to its "capture," and possibly its location, and the path by which it was exfiltrated or removed.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-21

SI-21 Information Refresh
Family: System and Information Integrity (SI)

Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-21 > Discussion

SI-21 Information Refresh - Discussion
Family: System and Information Integrity (SI)

Retaining information for longer than it is needed makes it an increasingly valuable and enticing target for adversaries. Keeping information available for the minimum period of time needed to support organizational missions or business functions reduces the opportunity for adversaries to compromise, capture, and exfiltrate that information.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-22

SI-22 Information Diversity
Family: System and Information Integrity (SI)

a. Identify the following alternative sources of information for [Assignment: organization-defined essential functions and services]: [Assignment: organization-defined alternative information sources] ; and
b. Use an alternative information source for the execution of essential functions or services on [Assignment: organization-defined systems or system components] when the primary source of information is corrupted or unavailable.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-22 > Discussion

SI-22 Information Diversity - Discussion
Family: System and Information Integrity (SI)

Actions taken by a system service or a function are often driven by the information it receives. Corruption, fabrication, modification, or deletion of that information could impact the ability of the service function to properly carry out its intended actions. By having multiple sources of input, the service or function can continue operation if one source is corrupted or no longer available. It is possible that the alternative sources of information may be less precise or less accurate than the primary source of information. But having such sub-optimal information sources may still provide a sufficient level of quality that the essential service or function can be carried out, even in a degraded or debilitated manner.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-23

SI-23 Information Fragmentation
Family: System and Information Integrity (SI)

Based on [Assignment: organization-defined circumstances]:
a. Fragment the following information: [Assignment: organization-defined information] ; and
b. Distribute the fragmented information across the following systems or system components: [Assignment: organization-defined systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-23 > Discussion

SI-23 Information Fragmentation - Discussion
Family: System and Information Integrity (SI)

One objective of the advanced persistent threat is to exfiltrate valuable information. Once exfiltrated, there is generally no way for the organization to recover the lost information. Therefore, organizations may consider dividing the information into disparate elements and distributing those elements across multiple systems or system components and locations. Such actions will increase the adversary's work factor to capture and exfiltrate the desired information and, in so doing, increase the probability of detection. The fragmentation of information impacts the organization's ability to access the information in a timely manner. The extent of the fragmentation is dictated by the impact or classification level (and value) of the information, threat intelligence information received, and whether data tainting is used (i.e., data tainting-derived information about the exfiltration of some information could result in the fragmentation of the remaining information).