ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(4) > Assessment Methods

AC-20(4) Network Accessible Storage Devices - Prohibited Use - Assessment Methods and Objects

Examine: Access control policy

procedures addressing use of network-accessible storage devices in external systems

system design documentation

system configuration settings and associated documentation

system connection or processing agreements

list of network-accessible storage devices prohibited from use in external systems

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for prohibiting the use of network-accessible storage devices in external systems

system/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms prohibiting the use of network-accessible storage devices in external systems
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(4) > Assessment Objective

AC-20(4) Network Accessible Storage Devices - Prohibited Use - Assessment Objective
Determine if the following are satisfied:

the use of [Assignment: organization-defined network-accessible storage devices] is prohibited in external systems.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(5) > Assessment Methods

AC-20(5) Portable Storage Devices - Prohibited Use - Assessment Methods and Objects

Examine: Access control policy

procedures addressing use of portable storage devices in external systems

system design documentation

system configuration settings and associated documentation

system connection or processing agreements

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for prohibiting the use of portable storage devices in external systems

system/network administrators

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-20 > AC-20(5) > Assessment Objective

AC-20(5) Portable Storage Devices - Prohibited Use - Assessment Objective
Determine if the following are satisfied:

the use of organization-controlled portable storage devices by authorized individuals is prohibited on external systems.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-21 > Assessment Methods

AC-21 Information Sharing - Assessment Methods and Objects

Examine: Access control policy

procedures addressing user-based collaboration and information sharing (including restrictions)

system design documentation

system configuration settings and associated documentation

list of users authorized to make information-sharing/collaboration decisions

list of information-sharing circumstances requiring user discretion

non-disclosure agreements

acquisitions/contractual agreements

system security plan

privacy plan

privacy impact assessment

security and privacy risk assessments

other relevant documents or records

Interview: Organizational personnel responsible for information-sharing/collaboration decisions

organizational personnel with responsibility for acquisitions/contractual agreements

system/network administrators

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms or manual process implementing access authorizations supporting information-sharing/user collaboration decisions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-21 > Assessment Objective

AC-21 Information Sharing - Assessment Objective
Determine if the following are satisfied:

AC-21a. authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information's access and use restrictions for [Assignment: organization-defined information-sharing circumstances];
AC-21b. [Assignment: organization-defined automated mechanisms] are employed to assist users in making information-sharing and collaboration decisions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-21 > AC-21(1) > Assessment Methods

AC-21(1) Automated Decision Support - Assessment Methods and Objects

Examine: Access control policy

procedures addressing user-based collaboration and information sharing (including restrictions)

system design documentation

system configuration settings and associated documentation

system-generated list of users authorized to make information-sharing/collaboration decisions

system-generated list of sharing partners and access authorizations

system-generated list of access restrictions regarding information to be shared

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Automated mechanisms implementing access authorizations supporting information-sharing/user collaboration decisions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-21 > AC-21(1) > Assessment Objective

AC-21(1) Automated Decision Support - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined automated mechanisms] are employed to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-21 > AC-21(2) > Assessment Methods

AC-21(2) Information Search and Retrieval - Assessment Methods and Objects

Examine: Access control policy

procedures addressing user-based collaboration and information sharing (including restrictions)

system design documentation

system configuration settings and associated documentation

system-generated list of access restrictions regarding information to be shared

information search and retrieval records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities for system search and retrieval services

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: System search and retrieval services enforcing information-sharing restrictions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-21 > AC-21(2) > Assessment Objective

AC-21(2) Information Search and Retrieval - Assessment Objective
Determine if the following are satisfied:

information search and retrieval services that enforce [Assignment: organization-defined information-sharing restrictions] are implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-22 > Assessment Methods

AC-22 Publicly Accessible Content - Assessment Methods and Objects

Examine: Access control policy

procedures addressing publicly accessible content

list of users authorized to post publicly accessible content on organizational systems

training materials and/or records

records of publicly accessible information reviews

records of response to non-public information on public websites

system audit logs

security awareness training records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for managing publicly accessible information posted on organizational systems

organizational personnel with information security responsibilities

Test: Mechanisms implementing management of publicly accessible content
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-22 > Assessment Objective

AC-22 Publicly Accessible Content - Assessment Objective
Determine if the following are satisfied:

AC-22a. designated individuals are authorized to make information publicly accessible;
AC-22b. authorized individuals are trained to ensure that publicly accessible information does not contain non-public information;
AC-22c. the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included;
AC-22d.[01] the content on the publicly accessible system is reviewed for non-public information [Assignment: organization-defined frequency];
AC-22d.[02] non-public information is removed from the publicly accessible system, if discovered.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-23 > Assessment Methods

AC-23 Data Mining Protection - Assessment Methods and Objects

Examine: Access control policy

procedures for preventing and detecting data mining

policies and procedures addressing authorized data mining techniques

procedures addressing protection of data storage objects against data mining

system design documentation

system configuration settings and associated documentation

system audit logs

system audit records

procedures addressing differential privacy techniques

notifications of atypical database queries or accesses

documentation or reports of insider threat program

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for implementing data mining detection and prevention techniques for data storage objects

legal counsel

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing data mining prevention and detection
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-23 > Assessment Objective

AC-23 Data Mining Protection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined techniques] are employed for [Assignment: organization-defined data storage objects] to detect and protect against unauthorized data mining.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-24 > Assessment Methods

AC-24 Access Control Decisions - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access control decisions

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for establishing procedures regarding access control decisions to the system

organizational personnel with information security responsibilities

Test: Mechanisms applying established access control decisions and procedures
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-24 > Assessment Objective

AC-24 Access Control Decisions - Assessment Objective
Determine if the following are satisfied:

[Selection; one or more: establish procedures; implement mechanisms] are taken to ensure that [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-24 > AC-24(1) > Assessment Methods

AC-24(1) Transmit Access Authorization Information - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-24 > AC-24(1) > Assessment Objective

AC-24(1) Transmit Access Authorization Information - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined access authorization information] is transmitted using [Assignment: organization-defined controls] to [Assignment: organization-defined systems] that enforce access control decisions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-24 > AC-24(2) > Assessment Methods

AC-24(2) No User or Process Identity - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security and privacy responsibilities

system developers

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-24 > AC-24(2) > Assessment Objective

AC-24(2) No User or Process Identity - Assessment Objective
Determine if the following are satisfied:

AC-24(02)[01] access control decisions are enforced based on [Assignment: organization-defined security attributes] that do not include the identity of the user or process acting on behalf of the user (if selected);
AC-24(02)[02] access control decisions are enforced based on [Assignment: organization-defined privacy attributes] that do not include the identity of the user or process acting on behalf of the user (if selected).
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-25 > Assessment Methods

AC-25 Reference Monitor - Assessment Methods and Objects

Examine: Access control policy

procedures addressing access enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with access enforcement responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access enforcement functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-25 > Assessment Objective

AC-25 Reference Monitor - Assessment Objective
Determine if the following are satisfied:

a reference monitor is implemented for [Assignment: organization-defined access control policies] that is tamper-proof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-1 > Assessment Methods

AT-1 Policy and Procedures - Assessment Methods and Objects

Examine: System security plan

privacy plan

awareness and training policy and procedures

other relevant documents or records

Interview: Organizational personnel with awareness and training responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-1 > Assessment Objective

AT-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

AT-01a.[01] an awareness and training policy is developed and documented;
AT-01a.[02] the awareness and training policy is disseminated to [Assignment: organization-defined personnel or roles];
AT-01a.[03] awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented;
AT-01a.[04] the awareness and training procedures are disseminated to [Assignment: organization-defined personnel or roles].
AT-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy addresses purpose;
AT-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy addresses scope;
AT-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy addresses roles;
AT-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy addresses responsibilities;
AT-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy addresses management commitment;
AT-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy addresses coordination among organizational entities;
AT-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy addresses compliance; and
AT-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and
AT-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures;
AT-01c.01[01] the current awareness and training policy is reviewed and updated [Assignment: organization-defined frequency];
AT-01c.01[02] the current awareness and training policy is reviewed and updated following [Assignment: organization-defined events];
AT-01c.02[01] the current awareness and training procedures are reviewed and updated [Assignment: organization-defined frequency];
AT-01c.02[02] the current awareness and training procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > Assessment Methods

AT-2 Literacy Training and Awareness - Assessment Methods and Objects

Examine: System security plan

privacy plan

literacy training and awareness policy

procedures addressing literacy training and awareness implementation

appropriate codes of federal regulations

security and privacy literacy training curriculum

security and privacy literacy training materials

training records

other relevant documents or records

Interview: Organizational personnel with responsibilities for literacy training and awareness

organizational personnel with information security and privacy responsibilities

organizational personnel comprising the general system user community

Test: Mechanisms managing information security and privacy literacy training
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > Assessment Objective

AT-2 Literacy Training and Awareness - Assessment Objective
Determine if the following are satisfied:

AT-02a.01[01] security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
AT-02a.01[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
AT-02a.01[03] security literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: organization-defined frequency] thereafter;
AT-02a.01[04] privacy literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: organization-defined frequency] thereafter;
AT-02a.02[01] security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: organization-defined events];
AT-02a.02[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: organization-defined events];
AT-02b. [Assignment: organization-defined awareness techniques] are employed to increase the security and privacy awareness of system users;
AT-02c.[01] literacy training and awareness content is updated [Assignment: organization-defined frequency];
AT-02c.[02] literacy training and awareness content is updated following [Assignment: organization-defined events];
AT-02d. lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(1) > Assessment Methods

AT-2(1) Practical Exercises - Assessment Methods and Objects

Examine: System security plan

privacy plan

security awareness and training policy

procedures addressing security awareness training implementation

security awareness training curriculum

security awareness training materials

other relevant documents or records

Interview: Organizational personnel who receive literacy training and awareness

organizational personnel with responsibilities for security awareness training

organizational personnel with information security responsibilities

Test: Mechanisms implementing cyber-attack simulations in practical exercises
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(1) > Assessment Objective

AT-2(1) Practical Exercises - Assessment Objective
Determine if the following are satisfied:

practical exercises in literacy training that simulate events and incidents are provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(2) > Assessment Methods

AT-2(2) Insider Threat - Assessment Methods and Objects

Examine: System security plan

privacy plan

literacy training and awareness policy

procedures addressing literacy training and awareness implementation

literacy training and awareness curriculum

literacy training and awareness materials

other relevant documents or records

Interview: Organizational personnel who receive literacy training and awareness

organizational personnel with responsibilities for literacy training and awareness

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(2) > Assessment Objective

AT-2(2) Insider Threat - Assessment Objective
Determine if the following are satisfied:

AT-02(02)[01] literacy training on recognizing potential indicators of insider threat is provided;
AT-02(02)[02] literacy training on reporting potential indicators of insider threat is provided.
Assessing Security and Privacy Controls in Information Systems and Organizations
AT > AT-2 > AT-2(3) > Assessment Methods

AT-2(3) Social Engineering and Mining - Assessment Methods and Objects

Examine: System security plan

privacy plan

literacy training and awareness policy

procedures addressing literacy training and awareness implementation

literacy training and awareness curriculum

literacy training and awareness materials

other relevant documents or records

Interview: Organizational personnel who receive literacy training and awareness

organizational personnel with responsibilities for literacy training and awareness

organizational personnel with information security and privacy responsibilities