ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(4) > Assessment Methods

AU-12(4) Query Parameter Audits of Personally Identifiable Information - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing audit record generation

query event records

system design documentation

system configuration settings and associated documentation

map of system data actions

system audit records

other relevant documents or records

Interview: Organizational personnel with audit record generation responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing audit record generation capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-12 > AU-12(4) > Assessment Objective

AU-12(4) Query Parameter Audits of Personally Identifiable Information - Assessment Objective
Determine if the following are satisfied:

AU-12(04)[01] the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided;
AU-12(04)[02] the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > Assessment Methods

AU-13 Monitoring for Information Disclosure - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing information disclosure monitoring

system design documentation

system configuration settings and associated documentation

monitoring records

system audit records

other relevant documents or records

Interview: Organizational personnel with responsibilities for monitoring open-source information and/or information sites

organizational personnel with security and privacy responsibilities

Test: Mechanisms implementing monitoring for information disclosure
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > Assessment Objective

AU-13 Monitoring for Information Disclosure - Assessment Objective
Determine if the following are satisfied:

AU-13a. [Assignment: organization-defined open-source information and/or information sites] is/are monitored [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information;
AU-13b.01 [Assignment: organization-defined personnel or roles] are notified if an information disclosure is discovered;
AU-13b.02 [Assignment: organization-defined additional actions] are taken if an information disclosure is discovered.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > AU-13(1) > Assessment Methods

AU-13(1) Use of Automated Tools - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing information disclosure monitoring

system design documentation

system configuration settings and associated documentation

automated monitoring tools

system audit records

other relevant documents or records

Interview: Organizational personnel with responsibilities for monitoring information disclosures

organizational personnel with information security and privacy responsibilities

Test: Automated mechanisms implementing monitoring for information disclosure
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > AU-13(1) > Assessment Objective

AU-13(1) Use of Automated Tools - Assessment Objective
Determine if the following are satisfied:

open-source information and information sites are monitored using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > AU-13(2) > Assessment Methods

AU-13(2) Review of Monitored Sites - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing information disclosure monitoring

system design documentation

system configuration settings and associated documentation

reviews for open-source information sites being monitored

system audit records

other relevant documents or records

Interview: Organizational personnel with responsibilities for monitoring open-source information sites

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing monitoring for information disclosure
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > AU-13(2) > Assessment Objective

AU-13(2) Review of Monitored Sites - Assessment Objective
Determine if the following are satisfied:

the list of open-source information sites being monitored is reviewed [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > AU-13(3) > Assessment Methods

AU-13(3) Unauthorized Replication of Information - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing information disclosure monitoring

procedures addressing information replication

system design documentation

system configuration settings and associated documentation

system audit records

training resources for staff to recognize the unauthorized use of organizational information

other relevant documents or records

Interview: Organizational personnel with responsibilities for monitoring unauthorized replication of information

organizational personnel with information security and privacy responsibilities

Test: Discovery tools for identifying unauthorized information replication
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-13 > AU-13(3) > Assessment Objective

AU-13(3) Unauthorized Replication of Information - Assessment Objective
Determine if the following are satisfied:

discovery techniques, processes, and tools are employed to determine if external entities are replicating organizational information in an unauthorized manner.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-14 > Assessment Methods

AU-14 Session Audit - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing user session auditing

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

legal counsel

personnel with civil liberties responsibilities

Test: Mechanisms implementing user session auditing capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-14 > Assessment Objective

AU-14 Session Audit - Assessment Objective
Determine if the following are satisfied:

AU-14a.[01] [Assignment: organization-defined users or roles] are provided with the capability to [Selection; one or more: record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances];
AU-14a.[02] the capability for [Assignment: organization-defined users or roles] to [Selection; one or more: record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances] is implemented;
AU-14b.[01] session auditing activities are developed in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
AU-14b.[02] session auditing activities are integrated in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
AU-14b.[03] session auditing activities are used in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-14 > AU-14(1) > Assessment Methods

AU-14(1) System Start-up - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing user session auditing

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Test: Mechanisms implementing user session auditing capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-14 > AU-14(1) > Assessment Objective

AU-14(1) System Start-up - Assessment Objective
Determine if the following are satisfied:

session audits are initiated automatically at system start-up.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-14 > AU-14(3) > Assessment Methods

AU-14(3) Remote Viewing and Listening - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing user session auditing

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

legal counsel

personnel with civil liberties responsibilities

Test: Mechanisms implementing user session auditing capability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-14 > AU-14(3) > Assessment Objective

AU-14(3) Remote Viewing and Listening - Assessment Objective
Determine if the following are satisfied:

AU-14(03)[01] the capability for authorized users to remotely view and hear content related to an established user session in real time is provided;
AU-14(03)[02] the capability for authorized users to remotely view and hear content related to an established user session in real time is implemented.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > Assessment Methods

AU-16 Cross-organizational Audit Logging - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing methods for coordinating audit information among external organizations

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with responsibilities for coordinating audit information among external organizations

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing cross-organizational auditing
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > Assessment Objective

AU-16 Cross-organizational Audit Logging - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries are employed.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > AU-16(1) > Assessment Methods

AU-16(1) Identity Preservation - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing cross-organizational audit trails

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with cross-organizational audit responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing cross-organizational auditing (if applicable)
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > AU-16(1) > Assessment Objective

AU-16(1) Identity Preservation - Assessment Objective
Determine if the following are satisfied:

the identity of individuals in cross-organizational audit trails is preserved.
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > AU-16(2) > Assessment Methods

AU-16(2) Sharing of Audit Information - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing cross-organizational sharing of audit information

information sharing agreements

other relevant documents or records

Interview: Organizational personnel with responsibilities for sharing cross-organizational audit information

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > AU-16(2) > Assessment Objective

AU-16(2) Sharing of Audit Information - Assessment Objective
Determine if the following are satisfied:

cross-organizational audit information is provided to [Assignment: organization-defined organizations] based on [Assignment: organization-defined cross-organizational sharing agreements].
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > AU-16(3) > Assessment Methods

AU-16(3) Disassociability - Assessment Methods and Objects

Examine: Audit and accountability policy

system security plan

privacy plan

procedures addressing cross-organizational sharing of audit information

policy and/or procedures regarding the deidentification of PII

system design documentation

system configuration settings and associated documentation

system audit records

other relevant documents or records

Interview: Organizational personnel with responsibilities for sharing cross-organizational audit information

organizational personnel with information security and privacy responsibilities

Test: Mechanisms implementing disassociability
Assessing Security and Privacy Controls in Information Systems and Organizations
AU > AU-16 > AU-16(3) > Assessment Objective

AU-16(3) Disassociability - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined measures] are implemented to disassociate individuals from audit information transmitted across organizational boundaries.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-1 > Assessment Methods

CA-1 Policy and Procedures - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy and procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with assessment, authorization, and monitoring policy responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > Assessment Methods

CA-2 Control Assessments - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing assessment planning

procedures addressing control assessments

control assessment plan

control assessment report

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with control assessment responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > Assessment Objective

CA-2 Control Assessments - Assessment Objective
Determine if the following are satisfied:

CA-02a. an appropriate assessor or assessment team is selected for the type of assessment to be conducted;
CA-02b.01 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;
CA-02b.02 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;
CA-02b.03[01] a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;
CA-02b.03[02] a control assessment plan is developed that describes the scope of the assessment, including the assessment team;
CA-02b.03[03] a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;
CA-02c. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
CA-02d.[01] controls are assessed in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
CA-02d.[02] controls are assessed in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;
CA-02e. a control assessment report is produced that documents the results of the assessment;
CA-02f. the results of the control assessment are provided to [Assignment: organization-defined individuals or roles].
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > CA-2(1) > Assessment Methods

CA-2(1) Independent Assessors - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing control assessments

previous control assessment plan

previous control assessment report

plan of action and milestones

existing authorization statement

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with security assessment responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > CA-2(1) > Assessment Objective

CA-2(1) Independent Assessors - Assessment Objective
Determine if the following are satisfied:

independent assessors or assessment teams are employed to conduct control assessments.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > CA-2(2) > Assessment Methods

CA-2(2) Specialized Assessments - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing control assessments

control assessment plan

control assessment report

control assessment evidence

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with control assessment responsibilities

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting control assessment
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > CA-2(2) > Assessment Objective

CA-2(2) Specialized Assessments - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined specialized assessment frequency] [Selection: announced; unannounced] [Selection; one or more: in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment] ] are included as part of control assessments.
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > CA-2(3) > Assessment Methods

CA-2(3) Leveraging Results from External Organizations - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

procedures addressing control assessments

control assessment requirements

control assessment plan

control assessment report

control assessment evidence

plan of action and milestones

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with control assessment responsibilities

organizational personnel with information security and privacy responsibilities

personnel performing control assessments for the specified external organization
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-2 > CA-2(3) > Assessment Objective

CA-2(3) Leveraging Results from External Organizations - Assessment Objective
Determine if the following are satisfied:

the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] are leveraged when the assessment meets [Assignment: organization-defined requirements].
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-3 > Assessment Methods

CA-3 Information Exchange - Assessment Methods and Objects

Examine: Access control policy

procedures addressing system connections

system and communications protection policy

system interconnection security agreements

information exchange security agreements

memoranda of understanding or agreements

service level agreements

non-disclosure agreements

system design documentation

enterprise architecture

system architecture

system configuration settings and associated documentation

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for developing, implementing, or approving system interconnection agreements

organizational personnel with information security and privacy responsibilities

personnel managing the system(s) to which the interconnection security agreement applies
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-3 > Assessment Objective

CA-3 Information Exchange - Assessment Objective
Determine if the following are satisfied:

CA-03a. the exchange of information between the system and other systems is approved and managed using [Selection; one or more: interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: organization-defined type of agreement] ];
CA-03b.[01] the interface characteristics are documented as part of each exchange agreement;
CA-03b.[02] security requirements are documented as part of each exchange agreement;
CA-03b.[03] privacy requirements are documented as part of each exchange agreement;
CA-03b.[04] controls are documented as part of each exchange agreement;
CA-03b.[05] responsibilities for each system are documented as part of each exchange agreement;
CA-03b.[06] the impact level of the information communicated is documented as part of each exchange agreement;
CA-03c. agreements are reviewed and updated [Assignment: organization-defined frequency].