ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-6 > Assessment Objective

SI-6 Security and Privacy Function Verification - Assessment Objective
Determine if the following are satisfied:

SI-06a.[01] [Assignment: organization-defined security functions] are verified to be operating correctly;
SI-06a.[02] [Assignment: organization-defined privacy functions] are verified to be operating correctly;
SI-06b.[01] [Assignment: organization-defined security functions] are verified [Selection; one or more: [Assignment: organization-defined system transitional states] ; upon command by user with appropriate privilege; [Assignment: organization-defined frequency] ];
SI-06b.[02] [Assignment: organization-defined privacy functions] are verified [Selection; one or more: [Assignment: organization-defined system transitional states] ; upon command by user with appropriate privilege; [Assignment: organization-defined frequency] ];
SI-06c.[01] [Assignment: organization-defined personnel or roles] is/are alerted to failed security verification tests;
SI-06c.[02] [Assignment: organization-defined personnel or roles] is/are alerted to failed privacy verification tests;
SI-06d. [Selection; one or more: shut the system down; restart the system; [Assignment: organization-defined alternative action(s)] ] is/are initiated when anomalies are discovered.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-6 > SI-6(2) > Assessment Methods

SI-6(2) Automation Support for Distributed Testing - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing security and privacy function verification

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security and privacy function verification responsibilities

organizational personnel implementing, operating, and maintaining the system

system/network administrators

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for security and privacy function verification

automated mechanisms supporting and/or implementing the management of distributed security and privacy testing
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-6 > SI-6(2) > Assessment Objective

SI-6(2) Automation Support for Distributed Testing - Assessment Objective
Determine if the following are satisfied:

SI-06(02)[01] automated mechanisms are implemented to support the management of distributed security function testing;
SI-06(02)[02] automated mechanisms are implemented to support the management of distributed privacy function testing.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-6 > SI-6(3) > Assessment Methods

SI-6(3) Report Verification Results - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing security and privacy function verification

system design documentation

system configuration settings and associated documentation

reports of security and privacy function verification results

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security and privacy function verification responsibilities

organizational personnel who are recipients of security and privacy function verification reports

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for reporting security and privacy function verification results

mechanisms supporting and/or implementing the reporting of security and privacy function verification results
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-6 > SI-6(3) > Assessment Objective

SI-6(3) Report Verification Results - Assessment Objective
Determine if the following are satisfied:

SI-06(03)[01] the results of security function verification are reported to [Assignment: organization-defined personnel or roles];
SI-06(03)[02] the results of privacy function verification are reported to [Assignment: organization-defined personnel or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > Assessment Methods

SI-7 Software, Firmware, and Information Integrity - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

personally identifiable information processing policy

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

records generated or triggered by integrity verification tools regarding unauthorized software, firmware, and information changes

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Software, firmware, and information integrity verification tools
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > Assessment Objective

SI-7 Software, Firmware, and Information Integrity - Assessment Objective
Determine if the following are satisfied:

SI-07a.[01] integrity verification tools are employed to detect unauthorized changes to [Assignment: organization-defined software];
SI-07a.[02] integrity verification tools are employed to detect unauthorized changes to [Assignment: organization-defined firmware];
SI-07a.[03] integrity verification tools are employed to detect unauthorized changes to [Assignment: organization-defined information];
SI-07b.[01] [Assignment: organization-defined actions] are taken when unauthorized changes to the software, are detected;
SI-07b.[02] [Assignment: organization-defined actions] are taken when unauthorized changes to the firmware are detected;
SI-07b.[03] [Assignment: organization-defined actions] are taken when unauthorized changes to the information are detected.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(1) > Assessment Methods

SI-7(1) Integrity Checks - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity testing

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

records of integrity scans

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Software, firmware, and information integrity verification tools
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(1) > Assessment Objective

SI-7(1) Integrity Checks - Assessment Objective
Determine if the following are satisfied:

SI-07(01)[01] an integrity check of [Assignment: organization-defined software] is performed [Selection; one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events] ; [Assignment: organization-defined frequency] ];
SI-07(01)[02] an integrity check of [Assignment: organization-defined firmware] is performed [Selection; one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events] ; [Assignment: organization-defined frequency] ];
SI-07(01)[03] an integrity check of [Assignment: organization-defined information] is performed [Selection; one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events] ; [Assignment: organization-defined frequency] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(2) > Assessment Methods

SI-7(2) Automated Notifications of Integrity Violations - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

personally identifiable information processing policy

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

records of integrity scans

automated tools supporting alerts and notifications for integrity discrepancies

notifications provided upon discovering discrepancies during integrity verifications

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security and privacy responsibilities

system administrators

software developers

Test: Software, firmware, and information integrity verification tools

mechanisms providing integrity discrepancy notifications
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(2) > Assessment Objective

SI-7(2) Automated Notifications of Integrity Violations - Assessment Objective
Determine if the following are satisfied:

automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(3) > Assessment Methods

SI-7(3) Centrally Managed Integrity Tools - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

records of integrity scans

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for the central management of integrity verification tools

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the central management of integrity verification tools
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(3) > Assessment Objective

SI-7(3) Centrally Managed Integrity Tools - Assessment Objective
Determine if the following are satisfied:

centrally managed integrity verification tools are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(5) > Assessment Methods

SI-7(5) Automated Response to Integrity Violations - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

records of integrity scans

records of integrity checks and responses to integrity violations

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Software, firmware, and information integrity verification tools

mechanisms providing an automated response to integrity violations

mechanisms supporting and/or implementing security safeguards to be implemented when integrity violations are discovered
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(5) > Assessment Objective

SI-7(5) Automated Response to Integrity Violations - Assessment Objective
Determine if the following are satisfied:

[Selection; one or more: shut down the system; restart the system; implement [Assignment: organization-defined controls] ] are automatically performed when integrity violations are discovered.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(6) > Assessment Methods

SI-7(6) Cryptographic Protection - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated documentation

records of detected unauthorized changes to software, firmware, and information

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Software, firmware, and information integrity verification tools

cryptographic mechanisms implementing software, firmware, and information integrity
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(6) > Assessment Objective

SI-7(6) Cryptographic Protection - Assessment Objective
Determine if the following are satisfied:

SI-07(06)[01] cryptographic mechanisms are implemented to detect unauthorized changes to software;
SI-07(06)[02] cryptographic mechanisms are implemented to detect unauthorized changes to firmware;
SI-07(06)[03] cryptographic mechanisms are implemented to detect unauthorized changes to information.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(7) > Assessment Methods

SI-7(7) Integration of Detection and Response - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

procedures addressing incident response

system design documentation

system configuration settings and associated documentation

incident response records

audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

organizational personnel with incident response responsibilities

Test: Organizational processes for incorporating the detection of unauthorized security-relevant changes into the incident response capability

software, firmware, and information integrity verification tools

mechanisms supporting and/or implementing the incorporation of detection of unauthorized security-relevant changes into the incident response capability
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(7) > Assessment Objective

SI-7(7) Integration of Detection and Response - Assessment Objective
Determine if the following are satisfied:

the detection of [Assignment: organization-defined changes] are incorporated into the organizational incident response capability.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(8) > Assessment Methods

SI-7(8) Auditing Capability for Significant Events - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

records of integrity scans

incident response records

list of security-relevant changes to the system

automated tools supporting alerts and notifications if unauthorized security changes are detected

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Software, firmware, and information integrity verification tools

mechanisms supporting and/or implementing the capability to audit potential integrity violations

mechanisms supporting and/or implementing alerts about potential integrity violations
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(8) > Assessment Objective

SI-7(8) Auditing Capability for Significant Events - Assessment Objective
Determine if the following are satisfied:

SI-07(08)[01] the capability to audit an event upon the detection of a potential integrity violation is provided;
SI-07(08)[02] [Selection; one or more: generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles] ; [Assignment: organization-defined other actions] ] is/are initiated upon the detection of a potential integrity violation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(9) > Assessment Methods

SI-7(9) Verify Boot Process - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

documentation

records of integrity verification scans

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system developer

Test: Software, firmware, and information integrity verification tools

mechanisms supporting and/or implementing integrity verification of the boot process
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(9) > Assessment Objective

SI-7(9) Verify Boot Process - Assessment Objective
Determine if the following are satisfied:

the integrity of the boot process of [Assignment: organization-defined system components] is verified.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(10) > Assessment Methods

SI-7(10) Protection of Boot Firmware - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

integrity verification tools and associated documentation

records of integrity verification scans

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Software, firmware, and information integrity verification tools

mechanisms supporting and/or implementing protection of the integrity of boot firmware

safeguards implementing protection of the integrity of boot firmware
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(10) > Assessment Objective

SI-7(10) Protection of Boot Firmware - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined mechanisms] are implemented to protect the integrity of boot firmware in [Assignment: organization-defined system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(12) > Assessment Methods

SI-7(12) Integrity Verification - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

integrity verification records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

Test: Software, firmware, and information integrity verification tools

mechanisms supporting and/or implementing verification of the integrity of user-installed software prior to execution
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(12) > Assessment Objective

SI-7(12) Integrity Verification - Assessment Objective
Determine if the following are satisfied:

the integrity of [Assignment: organization-defined user-installed software] is verified prior to execution.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(15) > Assessment Methods

SI-7(15) Code Authentication - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Cryptographic mechanisms authenticating software and firmware prior to installation
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(15) > Assessment Objective

SI-7(15) Code Authentication - Assessment Objective
Determine if the following are satisfied:

cryptographic mechanisms are implemented to authenticate [Assignment: organization-defined software or firmware components] prior to installation.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-7 > SI-7(16) > Assessment Methods

SI-7(16) Time Limit on Process Execution Without Supervision - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing software and information integrity

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Test: Software, firmware, and information integrity verification tools

mechanisms supporting and/or implementing time limits on process execution without supervision