ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(3) > Assessment Objective

PE-6(3) Video Surveillance - Assessment Objective
Determine if the following are satisfied:

PE-06(03)(a) video surveillance of [Assignment: organization-defined operational areas] is employed;
PE-06(03)(b) video recordings are reviewed [Assignment: organization-defined frequency];
PE-06(03)(c) video recordings are retained for [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(4) > Assessment Methods

PE-6(4) Monitoring Physical Access to Systems - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing physical access monitoring

physical access control logs or records

physical access control devices

access authorizations

access credentials

list of areas within the facility containing concentrations of system components or system components requiring additional physical access monitoring

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with physical access monitoring responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for monitoring physical access to the system

mechanisms supporting and/or implementing physical access monitoring for facility areas containing system components
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-6 > PE-6(4) > Assessment Objective

PE-6(4) Monitoring Physical Access to Systems - Assessment Objective
Determine if the following are satisfied:

physical access to the system is monitored in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-8 > Assessment Methods

PE-8 Visitor Access Records - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing visitor access records

visitor access control logs or records

visitor access record or log reviews

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Interview: Organizational personnel with visitor access record responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for maintaining and reviewing visitor access records

mechanisms supporting and/or implementing the maintenance and review of visitor access records
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-8 > Assessment Objective

PE-8 Visitor Access Records - Assessment Objective
Determine if the following are satisfied:

PE-08a. visitor access records for the facility where the system resides are maintained for [Assignment: organization-defined time period];
PE-08b. visitor access records are reviewed [Assignment: organization-defined frequency];
PE-08c. visitor access records anomalies are reported to [Assignment: organization-defined personnel].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-8 > PE-8(1) > Assessment Methods

PE-8(1) Automated Records Maintenance and Review - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing visitor access records

automated mechanisms supporting management of visitor access records

visitor access control logs or records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with visitor access record responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for maintaining and reviewing visitor access records

automated mechanisms supporting and/or implementing the maintenance and review of visitor access records
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-8 > PE-8(1) > Assessment Objective

PE-8(1) Automated Records Maintenance and Review - Assessment Objective
Determine if the following are satisfied:

PE-08(01)[01] visitor access records are maintained using [Assignment: organization-defined automated mechanisms];
PE-08(01)[02] visitor access records are reviewed using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-8 > PE-8(3) > Assessment Methods

PE-8(3) Limit Personally Identifiable Information Elements - Assessment Methods and Objects

Examine: Physical and environmental protection policy

personally identifiable information processing policy

privacy risk assessment documentation

privacy impact assessment

visitor access records

personally identifiable information inventory

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with visitor access records responsibilities

organizational personnel with information security and privacy responsibilities

Test: Organizational processes for maintaining and reviewing visitor access records
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-8 > PE-8(3) > Assessment Objective

PE-8(3) Limit Personally Identifiable Information Elements - Assessment Objective
Determine if the following are satisfied:

personally identifiable information contained in visitor access records is limited to [Assignment: organization-defined elements] identified in the privacy risk assessment.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-9 > Assessment Methods

PE-9 Power Equipment and Cabling - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing power equipment/cabling protection

facilities housing power equipment/cabling

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility to protect power equipment/cabling

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the protection of power equipment/cabling
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-9 > Assessment Objective

PE-9 Power Equipment and Cabling - Assessment Objective
Determine if the following are satisfied:

PE-09[01] power equipment for the system is protected from damage and destruction;
PE-09[02] power cabling for the system is protected from damage and destruction.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-9 > PE-9(1) > Assessment Methods

PE-9(1) Redundant Cabling - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing power equipment/cabling protection

facilities housing power equipment/cabling

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility to protect power equipment/cabling

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the protection of power equipment/cabling
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-9 > PE-9(1) > Assessment Objective

PE-9(1) Redundant Cabling - Assessment Objective
Determine if the following are satisfied:

redundant power cabling paths that are physically separated by [Assignment: organization-defined distance] are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-9 > PE-9(2) > Assessment Methods

PE-9(2) Automatic Voltage Controls - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing voltage control

security plan

list of critical system components requiring automatic voltage controls

automatic voltage control mechanisms and associated configurations

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for environmental protection of system components

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing automatic voltage controls
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-9 > PE-9(2) > Assessment Objective

PE-9(2) Automatic Voltage Controls - Assessment Objective
Determine if the following are satisfied:

automatic voltage controls for [Assignment: organization-defined critical system components] are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-10 > Assessment Methods

PE-10 Emergency Shutoff - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing power source emergency shutoff

emergency shutoff controls or switches

locations housing emergency shutoff switches and devices

security safeguards protecting the emergency power shutoff capability from unauthorized activation

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for the emergency power shutoff capability (both implementing and using the capability)

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing emergency power shutoff
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-10 > Assessment Objective

PE-10 Emergency Shutoff - Assessment Objective
Determine if the following are satisfied:

PE-10a. the capability to shut off power to [Assignment: organization-defined system or individual system components] in emergency situations is provided;
PE-10b. emergency shutoff switches or devices are placed in [Assignment: organization-defined location] to facilitate access for authorized personnel;
PE-10c. the emergency power shutoff capability is protected from unauthorized activation.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-11 > Assessment Methods

PE-11 Emergency Power - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing emergency power

uninterruptible power supply

uninterruptible power supply documentation

uninterruptible power supply test records

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for emergency power and/or planning

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing an uninterruptible power supply

the uninterruptable power supply
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-11 > Assessment Objective

PE-11 Emergency Power - Assessment Objective
Determine if the following are satisfied:

an uninterruptible power supply is provided to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-11 > PE-11(1) > Assessment Methods

PE-11(1) Alternate Power Supply - Minimal Operational Capability - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing emergency power

alternate power supply

alternate power supply documentation

alternate power supply test records

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for emergency power and/or planning

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing an alternate power supply

the alternate power supply
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-11 > PE-11(1) > Assessment Objective

PE-11(1) Alternate Power Supply - Minimal Operational Capability - Assessment Objective
Determine if the following are satisfied:

PE-11(01)[01] an alternate power supply provided for the system is activated [Selection: manually; automatically];
PE-11(01)[02] the alternate power supply provided for the system can maintain minimally required operational capability in the event of an extended loss of the primary power source.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-11 > PE-11(2) > Assessment Methods

PE-11(2) Alternate Power Supply - Self-contained - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing emergency power

alternate power supply

alternate power supply documentation

alternate power supply test records

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for emergency power and/or planning

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing an alternate power supply

the alternate power supply
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-11 > PE-11(2) > Assessment Objective

PE-11(2) Alternate Power Supply - Self-contained - Assessment Objective
Determine if the following are satisfied:

an alternate power supply provided for the system is activated [Selection: manually; automatically];
PE-11(02)(a) the alternate power supply provided for the system is self-contained;
PE-11(02)(b) the alternate power supply provided for the system is not reliant on external power generation;
PE-11(02)(c) the alternate power supply provided for the system is capable of maintaining [Selection: minimally required operational capability; full operational capability] in the event of an extended loss of the primary power source.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-12 > Assessment Methods

PE-12 Emergency Lighting - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing emergency lighting

emergency lighting documentation

emergency lighting test records

emergency exits and evacuation routes

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for emergency lighting and/or planning

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing an emergency lighting capability
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-12 > Assessment Objective

PE-12 Emergency Lighting - Assessment Objective
Determine if the following are satisfied:

PE-12[01] automatic emergency lighting that activates in the event of a power outage or disruption is employed for the system;
PE-12[02] automatic emergency lighting that activates in the event of a power outage or disruption is maintained for the system;
PE-12[03] automatic emergency lighting for the system covers emergency exits within the facility;
PE-12[04] automatic emergency lighting for the system covers evacuation routes within the facility.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-12 > PE-12(1) > Assessment Methods

PE-12(1) Essential Mission and Business Functions - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing emergency lighting

emergency lighting documentation

emergency lighting test records

emergency exits and evacuation routes

areas/locations within facility supporting essential missions and business functions

system security plan

other relevant documents or records

Interview: Organizational personnel with the responsibility for emergency lighting and/or planning

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the emergency lighting capability
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-12 > PE-12(1) > Assessment Objective

PE-12(1) Essential Mission and Business Functions - Assessment Objective
Determine if the following are satisfied:

emergency lighting is provided for all areas within the facility supporting essential mission and business functions.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > Assessment Methods

PE-13 Fire Protection - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing fire protection

fire suppression and detection devices/systems

fire suppression and detection devices/systems documentation

test records of fire suppression and detection devices/systems

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for fire detection and suppression devices/systems

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing fire suppression/detection devices/systems
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > Assessment Objective

PE-13 Fire Protection - Assessment Objective
Determine if the following are satisfied:

PE-13[01] fire detection systems are employed;
PE-13[02] employed fire detection systems are supported by an independent energy source;
PE-13[03] employed fire detection systems are maintained;
PE-13[04] fire suppression systems are employed;
PE-13[05] employed fire suppression systems are supported by an independent energy source;
PE-13[06] employed fire suppression systems are maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > PE-13(1) > Assessment Methods

PE-13(1) Detection Systems - Automatic Activation and Notification - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing fire protection

facility housing the information system

alarm service-level agreements

test records of fire suppression and detection devices/systems

fire suppression and detection devices/systems documentation

alerts/notifications of fire events

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for fire detection and suppression devices/systems

organizational personnel with responsibilities for notifying appropriate personnel, roles, and emergency responders of fires

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing fire detection devices/systems

activation of fire detection devices/systems (simulated)

automated notifications
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > PE-13(1) > Assessment Objective

PE-13(1) Detection Systems - Automatic Activation and Notification - Assessment Objective
Determine if the following are satisfied:

PE-13(01)[01] fire detection systems that activate automatically are employed in the event of a fire;
PE-13(01)[02] fire detection systems that notify [Assignment: organization-defined personnel or roles] automatically are employed in the event of a fire;
PE-13(01)[03] fire detection systems that notify [Assignment: organization-defined emergency responders] automatically are employed in the event of a fire.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > PE-13(2) > Assessment Methods

PE-13(2) Suppression Systems - Automatic Activation and Notification - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing fire protection

fire suppression and detection devices/systems documentation

facility housing the system

alarm service-level agreements

test records of fire suppression and detection devices/systems

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for fire detection and suppression devices/systems

organizational personnel with responsibilities for providing automatic notifications of any activation of fire suppression devices/systems to appropriate personnel, roles, and emergency responders

organizational personnel with information security responsibilities

Test: Automated mechanisms supporting and/or implementing fire suppression devices/systems

activation of fire suppression devices/systems (simulated)

automated notifications
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > PE-13(2) > Assessment Objective

PE-13(2) Suppression Systems - Automatic Activation and Notification - Assessment Objective
Determine if the following are satisfied:

PE-13(02)(a)[01] fire suppression systems that activate automatically are employed;
PE-13(02)(a)[02] fire suppression systems that notify [Assignment: organization-defined personnel or roles] automatically are employed;
PE-13(02)(a)[03] fire suppression systems that notify [Assignment: organization-defined emergency responders] automatically are employed;
PE-13(02)(b) an automatic fire suppression capability is employed when the facility is not staffed on a continuous basis.
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > PE-13(4) > Assessment Methods

PE-13(4) Inspections - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing fire protection

facility housing the system

inspection plans

inspection results

inspect reports

test records of fire suppression and detection devices/systems

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for planning, approving, and executing fire inspections

organizational personnel with information security responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-13 > PE-13(4) > Assessment Objective

PE-13(4) Inspections - Assessment Objective
Determine if the following are satisfied:

PE-13(04)[01] the facility undergoes fire protection inspections [Assignment: organization-defined frequency] by authorized and qualified inspectors;
PE-13(04)[02] the identified deficiencies from fire protection inspections are resolved within [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-14 > Assessment Methods

PE-14 Environmental Controls - Assessment Methods and Objects

Examine: Physical and environmental protection policy

procedures addressing temperature and humidity control

temperature and humidity controls

facility housing the system

temperature and humidity controls documentation

temperature and humidity records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for system environmental controls

organizational personnel with information security responsibilities

Test: Mechanisms supporting and/or implementing the maintenance and monitoring of temperature and humidity levels
Assessing Security and Privacy Controls in Information Systems and Organizations
PE > PE-14 > Assessment Objective

PE-14 Environmental Controls - Assessment Objective
Determine if the following are satisfied:

PE-14a. [Selection; one or more: temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control] ] levels are maintained at [Assignment: organization-defined acceptable levels] within the facility where the system resides;
PE-14b. environmental control levels are monitored [Assignment: organization-defined frequency].