ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-1 > Assessment Objective

PS-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

PS-01a.[01] a personnel security policy is developed and documented;
PS-01a.[02] the personnel security policy is disseminated to [Assignment: organization-defined personnel or roles];
PS-01a.[03] personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented;
PS-01a.[04] the personnel security procedures are disseminated to [Assignment: organization-defined personnel or roles];
PS-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy addresses purpose;
PS-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy addresses scope;
PS-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy addresses roles;
PS-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy addresses responsibilities;
PS-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy addresses management commitment;
PS-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy addresses coordination among organizational entities;
PS-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy addresses compliance;
PS-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] personnel security policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
PS-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures;
PS-01c.01[01] the current personnel security policy is reviewed and updated [Assignment: organization-defined frequency];
PS-01c.01[02] the current personnel security policy is reviewed and updated following [Assignment: organization-defined events];
PS-01c.02[01] the current personnel security procedures are reviewed and updated [Assignment: organization-defined frequency];
PS-01c.02[02] the current personnel security procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-2 > Assessment Methods

PS-2 Position Risk Designation - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing position categorization

appropriate codes of federal regulations

list of risk designations for organizational positions

records of position risk designation reviews and updates

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for assigning, reviewing, and updating position risk designations

organizational processes for establishing screening criteria
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-2 > Assessment Objective

PS-2 Position Risk Designation - Assessment Objective
Determine if the following are satisfied:

PS-02a. a risk designation is assigned to all organizational positions;
PS-02b. screening criteria are established for individuals filling organizational positions;
PS-02c. position risk designations are reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > Assessment Methods

PS-3 Personnel Screening - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing personnel screening

records of screened personnel

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for personnel screening
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > Assessment Objective

PS-3 Personnel Screening - Assessment Objective
Determine if the following are satisfied:

PS-03a. individuals are screened prior to authorizing access to the system;
PS-03b.[01] individuals are rescreened in accordance with [Assignment: organization-defined conditions requiring rescreening];
PS-03b.[02] where rescreening is so indicated, individuals are rescreened [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(1) > Assessment Methods

PS-3(1) Classified Information - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing personnel screening

records of screened personnel

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for clearing and indoctrinating personnel for access to classified information
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(1) > Assessment Objective

PS-3(1) Classified Information - Assessment Objective
Determine if the following are satisfied:

PS-03(01)[01] individuals accessing a system processing, storing, or transmitting classified information are cleared;
PS-03(01)[02] individuals accessing a system processing, storing, or transmitting classified information are indoctrinated to the highest classification level of the information to which they have access on the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(2) > Assessment Methods

PS-3(2) Formal Indoctrination - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing personnel screening

indoctrination documents

records of screened personnel

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for formal indoctrination for all relevant types of information to which personnel have access
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(2) > Assessment Objective

PS-3(2) Formal Indoctrination - Assessment Objective
Determine if the following are satisfied:

individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination are formally indoctrinated for all of the relevant types of information to which they have access on the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(3) > Assessment Methods

PS-3(3) Information Requiring Special Protective Measures - Assessment Methods and Objects

Examine: Personnel security policy

access control policy, procedures addressing personnel screening

records of screened personnel

screening criteria

records of access authorizations

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for ensuring valid access authorizations for information requiring special protection

organizational process for additional personnel screening for information requiring special protection
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(3) > Assessment Objective

PS-3(3) Information Requiring Special Protective Measures - Assessment Objective
Determine if the following are satisfied:

PS-03(03)(a) individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties;
PS-03(03)(b) individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [Assignment: organization-defined additional personnel screening criteria].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(4) > Assessment Methods

PS-3(4) Citizenship Requirements - Assessment Methods and Objects

Examine: Personnel security policy

access control policy, procedures addressing personnel screening

records of screened personnel

screening criteria

records of access authorizations

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for ensuring valid access authorizations for information requiring citizenship

organizational process for additional personnel screening for information requiring citizenship
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-3 > PS-3(4) > Assessment Objective

PS-3(4) Citizenship Requirements - Assessment Objective
Determine if the following are satisfied:

individuals accessing a system processing, storing, or transmitting [Assignment: organization-defined information types] meet [Assignment: organization-defined citizenship requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-4 > Assessment Methods

PS-4 Personnel Termination - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing personnel termination

records of personnel termination actions

list of system accounts

records of terminated or revoked authenticators/credentials

records of exit interviews

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Organizational processes for personnel termination

mechanisms supporting and/or implementing personnel termination notifications

mechanisms for disabling system access/revoking authenticators
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-4 > Assessment Objective

PS-4 Personnel Termination - Assessment Objective
Determine if the following are satisfied:

PS-04a. upon termination of individual employment, system access is disabled within [Assignment: organization-defined time period];
PS-04b. upon termination of individual employment, any authenticators and credentials are terminated or revoked;
PS-04c. upon termination of individual employment, exit interviews that include a discussion of [Assignment: organization-defined information security topics] are conducted;
PS-04d. upon termination of individual employment, all security-related organizational system-related property is retrieved;
PS-04e. upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-4 > PS-4(1) > Assessment Methods

PS-4(1) Post-employment Requirements - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing personnel termination

signed post-employment acknowledgement forms

list of applicable, legally binding post-employment requirements

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for post-employment requirements
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-4 > PS-4(1) > Assessment Objective

PS-4(1) Post-employment Requirements - Assessment Objective
Determine if the following are satisfied:

PS-04(01)(a) terminated individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information;
PS-04(01)(b) terminated individuals are required to sign an acknowledgement of post-employment requirements as part of the organizational termination process.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-4 > PS-4(2) > Assessment Methods

PS-4(2) Automated Actions - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing personnel termination

system design documentation

system configuration settings and associated documentation

records of personnel termination actions

automated notifications of employee terminations

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for personnel termination

automated mechanisms supporting and/or implementing personnel termination notifications
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-4 > PS-4(2) > Assessment Objective

PS-4(2) Automated Actions - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined automated mechanisms] are used to [Selection; one or more: notify [Assignment: organization-defined personnel or roles] of individual termination actions; disable access to system resources].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-5 > Assessment Methods

PS-5 Personnel Transfer - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing personnel transfer

records of personnel transfer actions

list of system and facility access authorizations

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Test: Organizational processes for personnel transfer

mechanisms supporting and/or implementing personnel transfer notifications

mechanisms for disabling system access/revoking authenticators
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-5 > Assessment Objective

PS-5 Personnel Transfer - Assessment Objective
Determine if the following are satisfied:

PS-05a. the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization;
PS-05b. [Assignment: organization-defined transfer or reassignment actions] are initiated within [Assignment: organization-defined time period following the formal transfer action];
PS-05c. access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer;
PS-05d. [Assignment: organization-defined personnel or roles] are notified within [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-6 > Assessment Methods

PS-6 Access Agreements - Assessment Methods and Objects

Examine: Personnel security policy

personnel security procedures

procedures addressing access agreements for organizational information and systems

access control policy

access control procedures

access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)

documentation of access agreement reviews, updates, and re-signing

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel who have signed/resigned access agreements

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for reviewing, updating, and re-signing access agreements

mechanisms supporting the reviewing, updating, and re-signing of access agreements
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-6 > Assessment Objective

PS-6 Access Agreements - Assessment Objective
Determine if the following are satisfied:

PS-06a. access agreements are developed and documented for organizational systems;
PS-06b. the access agreements are reviewed and updated [Assignment: organization-defined frequency];
PS-06c.01 individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access;
PS-06c.02 individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-6 > PS-6(2) > Assessment Methods

PS-6(2) Classified Information Requiring Special Protection - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing access agreements for organizational information and systems

access agreements

access authorizations

personnel security criteria

signed non-disclosure agreements

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel who have signed non-disclosure agreements

organizational personnel with information security responsibilities

Test: Organizational processes for access to classified information requiring special protection
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-6 > PS-6(2) > Assessment Objective

PS-6(2) Classified Information Requiring Special Protection - Assessment Objective
Determine if the following are satisfied:

PS-06(02)(a) access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties;
PS-06(02)(b) access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria;
PS-06(02)(c) access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a non-disclosure agreement.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-6 > PS-6(3) > Assessment Methods

PS-6(3) Post-employment Requirements - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing access agreements for organizational information and systems

signed post-employment acknowledgement forms

access agreements

list of applicable, legally binding post-employment requirements

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel who have signed access agreements that include post-employment requirements

organizational personnel with information security responsibilities

Test: Organizational processes for post-employment requirements

mechanisms supporting notifications and individual acknowledgements of post-employment requirements
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-6 > PS-6(3) > Assessment Objective

PS-6(3) Post-employment Requirements - Assessment Objective
Determine if the following are satisfied:

PS-06(03)(a) individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information;
PS-06(03)(b) individuals are required to sign an acknowledgement of applicable, legally binding post-employment requirements as part of being granted initial access to covered information.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-7 > Assessment Methods

PS-7 External Personnel Security - Assessment Methods and Objects

Examine: Personnel security policy

procedures addressing external personnel security

list of personnel security requirements

acquisition documents

service-level agreements

compliance monitoring process

system security plan

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

external providers

system/network administrators

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

Test: Organizational processes for managing and monitoring external personnel security

mechanisms supporting and/or implementing the monitoring of provider compliance
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-7 > Assessment Objective

PS-7 External Personnel Security - Assessment Objective
Determine if the following are satisfied:

PS-07a. personnel security requirements are established, including security roles and responsibilities for external providers;
PS-07b. external providers are required to comply with personnel security policies and procedures established by the organization;
PS-07c. personnel security requirements are documented;
PS-07d. external providers are required to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [Assignment: organization-defined time period];
PS-07e. provider compliance with personnel security requirements is monitored.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-8 > Assessment Methods

PS-8 Personnel Sanctions - Assessment Methods and Objects

Examine: Personnel security policy

personnel security procedures

procedures addressing personnel sanctions

access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)

list of personnel or roles to be notified of formal employee sanctions

records or notifications of formal employee sanctions

system security plan

privacy plan

personally identifiable information processing policy

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

legal counsel

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for managing formal employee sanctions

mechanisms supporting and/or implementing formal employee sanctions notifications
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-8 > Assessment Objective

PS-8 Personnel Sanctions - Assessment Objective
Determine if the following are satisfied:

PS-08a. a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures;
PS-08b. [Assignment: organization-defined personnel or roles] is/are notified within [Assignment: organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.