ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-17 > Assessment Objective

SC-17 Public Key Infrastructure Certificates - Assessment Objective
Determine if the following are satisfied:

SC-17a. public key certificates are issued under [Assignment: organization-defined certificate policy] , or public key certificates are obtained from an approved service provider;
SC-17b. only approved trust anchors are included in trust stores or certificate stores managed by the organization.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > Assessment Methods

SC-18 Mobile Code - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing mobile code

mobile code implementation policy and procedures

list of acceptable mobile code and mobile code technologies

list of unacceptable mobile code and mobile technologies

authorization records

system monitoring records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing mobile code

Test: Organizational process for authorizing, monitoring, and controlling mobile code

mechanisms supporting and/or implementing the management of mobile code

mechanisms supporting and/or implementing the monitoring of mobile code
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > Assessment Objective

SC-18 Mobile Code - Assessment Objective
Determine if the following are satisfied:

SC-18a.[01] acceptable mobile code is defined;
SC-18a.[02] unacceptable mobile code is defined;
SC-18a.[03] acceptable mobile code technologies are defined;
SC-18a.[04] unacceptable mobile code technologies are defined;
SC-18b.[01] the use of mobile code is authorized within the system;
SC-18b.[02] the use of mobile code is monitored within the system;
SC-18b.[03] the use of mobile code is controlled within the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(1) > Assessment Methods

SC-18(1) Identify Unacceptable Code and Take Corrective Actions - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing mobile code

mobile code usage restrictions

mobile code implementation policy and procedures

system design documentation

system configuration settings and associated documentation

list of unacceptable mobile code

list of corrective actions to be taken when unacceptable mobile code is identified

system monitoring records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing mobile code

Test: Mechanisms supporting and/or implementing mobile code detection, inspection, and corrective capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(1) > Assessment Objective

SC-18(1) Identify Unacceptable Code and Take Corrective Actions - Assessment Objective
Determine if the following are satisfied:

SC-18(01)[01] [Assignment: organization-defined unacceptable mobile code] is identified;
SC-18(01)[02] [Assignment: organization-defined corrective actions] are taken if unacceptable mobile code is identified.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(2) > Assessment Methods

SC-18(2) Acquisition, Development, and Use - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing mobile code

mobile code requirements

mobile code usage restrictions

mobile code implementation policy and procedures

acquisition documentation

acquisition contracts for system, system component, or system service

system development life cycle documentation

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing mobile code

organizational personnel with acquisition and contracting responsibilities

Test: Organizational processes for the acquisition, development, and use of mobile code
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(2) > Assessment Objective

SC-18(2) Acquisition, Development, and Use - Assessment Objective
Determine if the following are satisfied:

SC-18(02)[01] the acquisition of mobile code to be deployed in the system meets [Assignment: organization-defined mobile code requirements];
SC-18(02)[02] the development of mobile code to be deployed in the system meets [Assignment: organization-defined mobile code requirements];
SC-18(02)[03] the use of mobile code to be deployed in the system meets [Assignment: organization-defined mobile code requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(3) > Assessment Methods

SC-18(3) Prevent Downloading and Execution - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing mobile code

mobile code usage restrictions

mobile code implementation policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing mobile code

Test: Mechanisms preventing the download and execution of unacceptable mobile code
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(3) > Assessment Objective

SC-18(3) Prevent Downloading and Execution - Assessment Objective
Determine if the following are satisfied:

SC-18(03)[01] the download of [Assignment: organization-defined unacceptable mobile code] is prevented;
SC-18(03)[02] the execution of [Assignment: organization-defined unacceptable mobile code] is prevented.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(4) > Assessment Methods

SC-18(4) Prevent Automatic Execution - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing mobile code

mobile code usage restrictions

mobile code implementation policy and procedures

system design documentation

system configuration settings and associated documentation

list of software applications in which the automatic execution of mobile code must be prohibited

list of actions required before execution of mobile code

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing mobile code

Test: Mechanisms preventing the automatic execution of unacceptable mobile code

mechanisms enforcing actions to be taken prior to the execution of the mobile code
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(4) > Assessment Objective

SC-18(4) Prevent Automatic Execution - Assessment Objective
Determine if the following are satisfied:

SC-18(04)[01] the automatic execution of mobile code in [Assignment: organization-defined software applications] is prevented;
SC-18(04)[02] [Assignment: organization-defined actions] are enforced prior to executing mobile code.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(5) > Assessment Methods

SC-18(5) Allow Execution Only in Confined Environments - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing mobile code

mobile code usage allowances

mobile code usage restrictions

system design documentation

system configuration settings and associated documentation

list of confined virtual machine environments in which the execution of organizationally acceptable mobile code is allowed

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing mobile code

Test: Mechanisms allowing for the execution of permitted mobile code in confined virtual machine environments
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-18 > SC-18(5) > Assessment Objective

SC-18(5) Allow Execution Only in Confined Environments - Assessment Objective
Determine if the following are satisfied:

execution of permitted mobile code is allowed only in confined virtual machine environments.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-20 > Assessment Methods

SC-20 Secure Name/Address Resolution Service (Authoritative Source) - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing secure name/address resolution services (authoritative source)

system design documentation

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing DNS

Test: Mechanisms supporting and/or implementing secure name/address resolution services
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-20 > Assessment Objective

SC-20 Secure Name/Address Resolution Service (Authoritative Source) - Assessment Objective
Determine if the following are satisfied:

SC-20a.[01] additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries;
SC-20a.[02] integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries;
SC-20b.[01] the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace;
SC-20b.[02] the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-20 > SC-20(2) > Assessment Methods

SC-20(2) Data Origin and Integrity - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing secure name/address resolution services (authoritative source)

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing DNS

Test: Mechanisms supporting and/or implementing data origin and integrity protection for internal name/address resolution service queries
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-20 > SC-20(2) > Assessment Objective

SC-20(2) Data Origin and Integrity - Assessment Objective
Determine if the following are satisfied:

SC-20(02)[01] data origin artifacts are provided for internal name/address resolution queries;
SC-20(02)[02] integrity protection artifacts are provided for internal name/address resolution queries.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-21 > Assessment Methods

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing secure name/address resolution services (recursive or caching resolver)

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing DNS

Test: Mechanisms supporting and/or implementing data origin authentication and data integrity verification for name/address resolution services
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-21 > Assessment Objective

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) - Assessment Objective
Determine if the following are satisfied:

SC-21[01] data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources;
SC-21[02] data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources;
SC-21[03] data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources;
SC-21[04] data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-22 > Assessment Methods

SC-22 Architecture and Provisioning for Name/Address Resolution Service - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing architecture and provisioning for name/address resolution services

access control policy and procedures

system design documentation

assessment results from independent testing organizations

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing DNS

Test: Mechanisms supporting and/or implementing name/address resolution services for fault tolerance and role separation
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-22 > Assessment Objective

SC-22 Architecture and Provisioning for Name/Address Resolution Service - Assessment Objective
Determine if the following are satisfied:

SC-22[01] the systems that collectively provide name/address resolution services for an organization are fault-tolerant;
SC-22[02] the systems that collectively provide name/address resolution services for an organization implement internal role separation;
SC-22[03] the systems that collectively provide name/address resolution services for an organization implement external role separation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > Assessment Methods

SC-23 Session Authenticity - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing session authenticity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing session authenticity
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > Assessment Objective

SC-23 Session Authenticity - Assessment Objective
Determine if the following are satisfied:

the authenticity of communication sessions is protected.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > SC-23(1) > Assessment Methods

SC-23(1) Invalidate Session Identifiers at Logout - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing session authenticity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing session identifier invalidation upon session termination
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > SC-23(1) > Assessment Objective

SC-23(1) Invalidate Session Identifiers at Logout - Assessment Objective
Determine if the following are satisfied:

session identifiers are invalidated upon user logout or other session termination.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > SC-23(3) > Assessment Methods

SC-23(3) Unique System-generated Session Identifiers - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing session authenticity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting, implementing, generating, and monitoring unique session identifiers

mechanisms supporting and/or implementing randomness requirements
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > SC-23(3) > Assessment Objective

SC-23(3) Unique System-generated Session Identifiers - Assessment Objective
Determine if the following are satisfied:

SC-23(03)[01] a unique session identifier is generated for each session with [Assignment: organization-defined randomness requirements];
SC-23(03)[02] only system-generated session identifiers are recognized.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > SC-23(5) > Assessment Methods

SC-23(5) Allowed Certificate Authorities - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing session authenticity

system design documentation

system configuration settings and associated documentation

list of certificate authorities allowed for verification of the establishment of protected sessions

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the management of certificate authorities
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-23 > SC-23(5) > Assessment Objective

SC-23(5) Allowed Certificate Authorities - Assessment Objective
Determine if the following are satisfied:

only the use of [Assignment: organization-defined certificated authorities] for verification of the establishment of protected sessions is allowed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-24 > Assessment Methods

SC-24 Fail in Known State - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing system failure to known state

system design documentation

system configuration settings and associated documentation

list of failures requiring system to fail in a known state

state information to be preserved in system failure

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing the fail in known state capability

mechanisms preserving system state information in the event of a system failure
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-24 > Assessment Objective

SC-24 Fail in Known State - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined types of system failures on system components] fail to a [Assignment: organization-defined known system state] while preserving [Assignment: organization-defined system state information] in failure.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-25 > Assessment Methods

SC-25 Thin Nodes - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing use of thin nodes

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing thin nodes
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-25 > Assessment Objective

SC-25 Thin Nodes - Assessment Objective
Determine if the following are satisfied:

SC-25[01] minimal functionality for [Assignment: organization-defined system components] is employed;
SC-25[02] minimal information storage on [Assignment: organization-defined system components] is allocated.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-26 > Assessment Methods

SC-26 Decoys - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing the use of decoys

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing decoys
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-26 > Assessment Objective

SC-26 Decoys - Assessment Objective
Determine if the following are satisfied:

SC-26[01] components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks;
SC-26[02] components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks;
SC-26[03] components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-27 > Assessment Methods

SC-27 Platform-independent Applications - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing platform-independent applications

system design documentation

system configuration settings and associated documentation

list of platform-independent applications

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developer

Test: Mechanisms supporting and/or implementing platform-independent applications
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-27 > Assessment Objective

SC-27 Platform-independent Applications - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined platform-independent applications] are included within organizational systems.