ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-41 > Assessment Methods

SC-41 Port and I/O Device Access - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

procedures addressing port and input/output device access

system design documentation

system configuration settings and associated documentation

system architecture

systems or system components

list of connection ports or input/output devices to be physically disabled or removed on systems or system components

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing the disabling of connection ports or input/output devices
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-41 > Assessment Objective

SC-41 Port and I/O Device Access - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined connection ports or input/output devices] are [Selection: physically; logically] disabled or removed on [Assignment: organization-defined systems or system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > Assessment Methods

SC-42 Sensor Capability and Data - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing sensor capabilities and data collection

access control policy and procedures

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for sensor capabilities

Test: Mechanisms implementing access controls for the remote activation of system sensor capabilities

mechanisms implementing the capability to indicate sensor use
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > Assessment Objective

SC-42 Sensor Capability and Data - Assessment Objective
Determine if the following are satisfied:

SC-42a. [Selection; one or more: the use of devices possessing [Assignment: organization-defined environmental sensing capabilities] in [Assignment: organization-defined facilities, areas, or systems] ; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [Assignment: organization-defined exceptions where remote activation of sensors is allowed] ] is/are prohibited;
SC-42b. an explicit indication of sensor use is provided to [Assignment: organization-defined group of users].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(1) > Assessment Methods

SC-42(1) Reporting to Authorized Individuals or Roles - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

procedures addressing sensor capability and data collection

personally identifiable information processing policy

system design documentation

system configuration settings and associated documentation

system architecture

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

system developer

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for the sensor capabilities

Test: Mechanisms restricting the reporting of sensor information to those authorized

sensor data collection and reporting capabilities for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(1) > Assessment Objective

SC-42(1) Reporting to Authorized Individuals or Roles - Assessment Objective
Determine if the following are satisfied:

the system is configured so that data or information collected by the [Assignment: organization-defined sensors] is only reported to authorized individuals or roles.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(2) > Assessment Methods

SC-42(2) Authorized Use - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

personally identifiable information processing policy

sensor capability and data collection

system design documentation

system configuration settings and associated documentation

system architecture

list of measures to be employed to that the ensure data or information collected by sensors is only used for authorized purposes

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for sensor capabilities

Test: Mechanisms supporting and/or implementing measures to ensure that sensor information is only used for authorized purposes

sensor information collection capability for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(2) > Assessment Objective

SC-42(2) Authorized Use - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined measures] are employed so that data or information collected by [Assignment: organization-defined sensors] is only used for authorized purposes.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(4) > Assessment Methods

SC-42(4) Notice of Collection - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

personally identifiable information processing policy

sensor capability and data collection policy and procedures

system design documentation

system configuration settings and associated documentation

privacy risk assessment documentation

privacy impact assessments

system architecture

list of measures to be employed to ensure that individuals are aware that personally identifiable information is being collected by sensors

examples of notifications provided to individuals that personally identifiable information is being collected by sensors

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for sensor capabilities

Test: Mechanisms supporting and/or implementing measures to facilitate an individual's awareness that personally identifiable information is being collected by sensors

sensor information collection capabilities for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(4) > Assessment Objective

SC-42(4) Notice of Collection - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined measures] are employed to facilitate an individual's awareness that personally identifiable information is being collected by [Assignment: organization-defined sensors]
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(5) > Assessment Methods

SC-42(5) Collection Minimization - Assessment Methods and Objects

Examine: System and communications protection policy

access control policy and procedures

personally identifiable information processing policy

sensor capability and data collection policy and procedures

system design documentation

system configuration settings and associated documentation

privacy risk assessment documentation

privacy impact assessments

system architecture

list of information being collected by sensors

list of sensor configurations that minimize the collection of personally identifiable information (e.g., obscure human features)

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for sensor capabilities

Test: Mechanisms supporting and/or implementing measures to facilitate the review of information that is being collected by sensors

sensor information collection capabilities for the system
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-42 > SC-42(5) > Assessment Objective

SC-42(5) Collection Minimization - Assessment Objective
Determine if the following are satisfied:

the [Assignment: organization-defined sensors] configured to minimize the collection of information about individuals that is not needed are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-43 > Assessment Methods

SC-43 Usage Restrictions - Assessment Methods and Objects

Examine: System and communications protection policy

usage restrictions

procedures addressing usage restrictions

implementation policy and procedures

authorization records

system monitoring records

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Organizational processes for authorizing, monitoring, and controlling the use of components with usage restrictions

mechanisms supporting and/or implementing, authorizing, monitoring, and controlling the use of components with usage restrictions
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-43 > Assessment Objective

SC-43 Usage Restrictions - Assessment Objective
Determine if the following are satisfied:

SC-43a. usage restrictions and implementation guidelines are established for [Assignment: organization-defined components];
SC-43b.[01] the use of [Assignment: organization-defined components] is authorized within the system;
SC-43b.[02] the use of [Assignment: organization-defined components] is monitored within the system;
SC-43b.[03] the use of [Assignment: organization-defined components] is controlled within the system.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-44 > Assessment Methods

SC-44 Detonation Chambers - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing detonation chambers

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing the detonation chamber capability
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-44 > Assessment Objective

SC-44 Detonation Chambers - Assessment Objective
Determine if the following are satisfied:

a detonation chamber capability is employed within the [Assignment: organization-defined system, system component, or location].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-45 > Assessment Methods

SC-45 System Time Synchronization - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing time synchronization

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing system time synchronization
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-45 > Assessment Objective

SC-45 System Time Synchronization - Assessment Objective
Determine if the following are satisfied:

system clocks are synchronized within and between systems and system components.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-45 > SC-45(1) > Assessment Methods

SC-45(1) Synchronization with Authoritative Time Source - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing time synchronization

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing system time synchronization
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-45 > SC-45(1) > Assessment Objective

SC-45(1) Synchronization with Authoritative Time Source - Assessment Objective
Determine if the following are satisfied:

SC-45(01)(a) the internal system clocks are compared [Assignment: organization-defined frequency] with [Assignment: organization-defined authoritative time source];
SC-45(01)(b) the internal system clocks are synchronized with the authoritative time source when the time difference is greater than [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-45 > SC-45(2) > Assessment Methods

SC-45(2) Secondary Authoritative Time Source - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing time synchronization

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing system time synchronization with secondary authoritative time sources
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-45 > SC-45(2) > Assessment Objective

SC-45(2) Secondary Authoritative Time Source - Assessment Objective
Determine if the following are satisfied:

SC-45(02)(a) a secondary authoritative time source is identified that is in a different geographic region than the primary authoritative time source;
SC-45(02)(b) the internal system clocks are synchronized to the secondary authoritative time source if the primary authoritative time source is unavailable.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-46 > Assessment Methods

SC-46 Cross Domain Policy Enforcement - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cross-domain policy enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing cross-domain policy enforcement
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-46 > Assessment Objective

SC-46 Cross Domain Policy Enforcement - Assessment Objective
Determine if the following are satisfied:

a policy enforcement mechanism is [Selection: physically; logically] implemented between the physical and/or network interfaces for the connecting security domains.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-47 > Assessment Methods

SC-47 Alternate Communications Paths - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing communication paths

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms supporting and/or implementing alternate communication paths for system operations
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-47 > Assessment Objective

SC-47 Alternate Communications Paths - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined alternate communication paths] are established for system operations and operational command and control.
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-48 > Assessment Methods

SC-48 Sensor Relocation - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing sensor and monitoring capability relocation

list of sensors/monitoring capabilities to be relocated

change control records

configuration management records

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing sensor relocation
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-48 > Assessment Objective

SC-48 Sensor Relocation - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined sensors and monitoring capabilities] are relocated to [Assignment: organization-defined locations] under [Assignment: organization-defined conditions or circumstances].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-48 > SC-48(1) > Assessment Methods

SC-48(1) Dynamic Relocation of Sensors or Monitoring Capabilities - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing sensor and monitoring capability relocation

list of sensors/monitoring capabilities to be relocated

change control records

configuration management records

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: SELECT FROM: Mechanisms supporting and/or implementing sensor relocation
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-48 > SC-48(1) > Assessment Objective

SC-48(1) Dynamic Relocation of Sensors or Monitoring Capabilities - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined sensors and monitoring capabilities] are dynamically relocated to [Assignment: organization-defined locations] under [Assignment: organization-defined conditions or circumstances].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-49 > Assessment Methods

SC-49 Hardware-enforced Separation and Policy Enforcement - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cross-domain policy enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing hardware-enforced security domain separation and policy enforcement
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-49 > Assessment Objective

SC-49 Hardware-enforced Separation and Policy Enforcement - Assessment Objective
Determine if the following are satisfied:

hardware-enforced separation and policy enforcement mechanisms are implemented between [Assignment: organization-defined security domains].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-50 > Assessment Methods

SC-50 Software-enforced Separation and Policy Enforcement - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing cross-domain policy enforcement

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

Test: Mechanisms supporting and/or implementing software-enforced separation and policy enforcement
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-50 > Assessment Objective

SC-50 Software-enforced Separation and Policy Enforcement - Assessment Objective
Determine if the following are satisfied:

software-enforced separation and policy enforcement mechanisms are implemented between [Assignment: organization-defined security domains].
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-51 > Assessment Methods

SC-51 Hardware-based Protection - Assessment Methods and Objects

Examine: System and communications protection policy

procedures addressing firmware modifications

system design documentation

system configuration settings and associated documentation

system architecture

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

system developers/integrators

Test: Organizational processes for modifying system firmware

mechanisms supporting and/or implementing hardware-based write-protection for system firmware