ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(1)

SI-7(1) Software, Firmware, and Information Integrity | Integrity Checks
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Perform an integrity check of [Assignment: organization-defined organization-defined software, firmware, and information] [Selection; one or more: at startup; at [Assignment: organization-defined organization-defined transitional states or security-relevant events] ; [Assignment: organization-defined organization-defined frequency] ].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(2) > Discussion

SI-7(2) Automated Notifications of Integrity Violations - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

The employment of automated tools to report system and information integrity violations and to notify organizational personnel in a timely matter is essential to effective risk response. Personnel with an interest in system and information integrity violations include mission and business owners, system owners, senior agency information security official, senior agency official for privacy, system administrators, software developers, systems integrators, information security officers, and privacy officers.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(2)

SI-7(2) Software, Firmware, and Information Integrity | Automated Notifications of Integrity Violations
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(3) > Discussion

SI-7(3) Centrally Managed Integrity Tools - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Centrally managed integrity verification tools provides greater consistency in the application of such tools and can facilitate more comprehensive coverage of integrity verification actions.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(3)

SI-7(3) Software, Firmware, and Information Integrity | Centrally Managed Integrity Tools
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Employ centrally managed integrity verification tools.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(5) > Discussion

SI-7(5) Automated Response to Integrity Violations - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Organizations may define different integrity-checking responses by type of information, specific information, or a combination of both. Types of information include firmware, software, and user data. Specific information includes boot firmware for certain types of machines. The automatic implementation of controls within organizational systems includes reversing the changes, halting the system, or triggering audit alerts when unauthorized modifications to critical security files occur.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(5)

SI-7(5) Software, Firmware, and Information Integrity | Automated Response to Integrity Violations
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Automatically [Selection; one or more: shut down the system; restart the system; implement [Assignment: organization-defined controls] ] when integrity violations are discovered.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(6) > Discussion

SI-7(6) Cryptographic Protection - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Cryptographic mechanisms used to protect integrity include digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(6)

SI-7(6) Software, Firmware, and Information Integrity | Cryptographic Protection
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(7) > Discussion

SI-7(7) Integration of Detection and Response - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of system privileges.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(7)

SI-7(7) Software, Firmware, and Information Integrity | Integration of Detection and Response
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined changes].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(8) > Discussion

SI-7(8) Auditing Capability for Significant Events - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Organizations select response actions based on types of software, specific software, or information for which there are potential integrity violations.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(8)

SI-7(8) Software, Firmware, and Information Integrity | Auditing Capability for Significant Events
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection; one or more: generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles] ; [Assignment: organization-defined other actions] ].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(9) > Discussion

SI-7(9) Verify Boot Process - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Ensuring the integrity of boot processes is critical to starting system components in known, trustworthy states. Integrity verification mechanisms provide a level of assurance that only trusted code is executed during boot processes.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(9)

SI-7(9) Software, Firmware, and Information Integrity | Verify Boot Process
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(10) > Discussion

SI-7(10) Protection of Boot Firmware - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Unauthorized modifications to boot firmware may indicate a sophisticated, targeted attack. These types of targeted attacks can result in a permanent denial of service or a persistent malicious code presence. These situations can occur if the firmware is corrupted or if the malicious code is embedded within the firmware. System components can protect the integrity of boot firmware in organizational systems by verifying the integrity and authenticity of all updates to the firmware prior to applying changes to the system component and preventing unauthorized processes from modifying the boot firmware.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(10)

SI-7(10) Software, Firmware, and Information Integrity | Protection of Boot Firmware
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(12) > Discussion

SI-7(12) Integrity Verification - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Organizations verify the integrity of user-installed software prior to execution to reduce the likelihood of executing malicious code or programs that contains errors from unauthorized modifications. Organizations consider the source of the software, ensuring the software and updates come from authorized sources and/or sites, and the practicality of approaches to verifying software integrity, including the availability of trustworthy checksums from software developers and vendors.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(12)

SI-7(12) Software, Firmware, and Information Integrity | Integrity Verification
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Require that the integrity of the following user-installed software be verified prior to execution: [Assignment: organization-defined user-installed software].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(15) > Discussion

SI-7(15) Code Authentication - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Cryptographic authentication includes verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(15)

SI-7(15) Software, Firmware, and Information Integrity | Code Authentication
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(16) > Discussion

SI-7(16) Time Limit on Process Execution Without Supervision - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Placing a time limit on process execution without supervision is intended to apply to processes for which typical or normal execution periods can be determined and situations in which organizations exceed such periods. Supervision includes timers on operating systems, automated responses, and manual oversight and response when system process anomalies occur.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(16)

SI-7(16) Software, Firmware, and Information Integrity | Time Limit on Process Execution Without Supervision
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Prohibit processes from executing without supervision for more than [Assignment: organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(17) > Discussion

SI-7(17) Runtime Application Self-protection - Discussion
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Runtime application self-protection employs runtime instrumentation to detect and block the exploitation of software vulnerabilities by taking advantage of information from the software in execution. Runtime exploit prevention differs from traditional perimeter-based protections such as guards and firewalls which can only detect and block attacks by using network information without contextual awareness. Runtime application self-protection technology can reduce the susceptibility of software to attacks by monitoring its inputs and blocking those inputs that could allow attacks. It can also help protect the runtime environment from unwanted changes and tampering. When a threat is detected, runtime application self-protection technology can prevent exploitation and take other actions (e.g., sending a warning message to the user, terminating the user's session, terminating the application, or sending an alert to organizational personnel). Runtime application self-protection solutions can be deployed in either a monitor or protection mode.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-7 > SI-7(17)

SI-7(17) Software, Firmware, and Information Integrity | Runtime Application Self-protection
Family: System and Information Integrity (SI) > SI-7 Software, Firmware, and Information Integrity

Implement [Assignment: organization-defined controls] for application self-protection at runtime.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-8

SI-8 Spam Protection
Family: System and Information Integrity (SI)

a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-8 > Discussion

SI-8 Spam Protection - Discussion
Family: System and Information Integrity (SI)

System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-8 > SI-8(2) > Discussion

SI-8(2) Automatic Updates - Discussion
Family: System and Information Integrity (SI) > SI-8 Spam Protection

Using automated mechanisms to update spam protection mechanisms helps to ensure that updates occur on a regular basis and provide the latest content and protection capabilities.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-8 > SI-8(2)

SI-8(2) Spam Protection | Automatic Updates
Family: System and Information Integrity (SI) > SI-8 Spam Protection

Automatically update spam protection mechanisms [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-8 > SI-8(3) > Discussion

SI-8(3) Continuous Learning Capability - Discussion
Family: System and Information Integrity (SI) > SI-8 Spam Protection

Learning mechanisms include Bayesian filters that respond to user inputs that identify specific traffic as spam or legitimate by updating algorithm parameters and thereby more accurately separating types of traffic.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-8 > SI-8(3)

SI-8(3) Spam Protection | Continuous Learning Capability
Family: System and Information Integrity (SI) > SI-8 Spam Protection

Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10

SI-10 Information Input Validation
Family: System and Information Integrity (SI)

Check the validity of the following information inputs: [Assignment: organization-defined information inputs].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > Discussion

SI-10 Information Input Validation - Discussion
Family: System and Information Integrity (SI)

Checking the valid syntax and semantics of system inputs-including character set, length, numerical range, and acceptable values-verifies that inputs match specified definitions for format and content. For example, if the organization specifies that numerical values between 1-100 are the only acceptable inputs for a field in a given application, inputs of "387," "abc," or "%K%" are invalid inputs and are not accepted as input to the system. Valid inputs are likely to vary from field to field within a software application. Applications typically follow well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. Structured messages can contain raw or unstructured data interspersed with metadata or control information. If software applications use attacker-supplied inputs to construct structured messages without properly encoding such messages, then the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. Consequently, the module or component that receives the corrupted output will perform the wrong operations or otherwise interpret the data incorrectly. Prescreening inputs prior to passing them to interpreters prevents the content from being unintentionally interpreted as commands. Input validation ensures accurate and correct inputs and prevents attacks such as cross-site scripting and a variety of injection attacks.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(1) > Discussion

SI-10(1) Manual Override Capability - Discussion
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

In certain situations, such as during events that are defined in contingency plans, a manual override capability for input validation may be needed. Manual overrides are used only in limited circumstances and with the inputs defined by the organization.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(1)

SI-10(1) Information Input Validation | Manual Override Capability
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

(a) Provide a manual override capability for input validation of the following information inputs: [Assignment: organization-defined information inputs];
(b) Restrict the use of the manual override capability to only [Assignment: organization-defined authorized individuals] ; and
(c) Audit the use of the manual override capability.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(2) > Discussion

SI-10(2) Review and Resolve Errors - Discussion
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

Resolution of input validation errors includes correcting systemic causes of errors and resubmitting transactions with corrected input. Input validation errors are those related to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(2)

SI-10(2) Information Input Validation | Review and Resolve Errors
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

Review and resolve input validation errors within [Assignment: organization-defined organization-defined time period].
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(3) > Discussion

SI-10(3) Predictable Behavior - Discussion
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects. The invalid inputs are those related to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(3)

SI-10(3) Information Input Validation | Predictable Behavior
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(4) > Discussion

SI-10(4) Timing Interactions - Discussion
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

In addressing invalid system inputs received across protocol interfaces, timing interactions become relevant, where one protocol needs to consider the impact of the error response on other protocols in the protocol stack. For example, 802.11 standard wireless network protocols do not interact well with Transmission Control Protocols (TCP) when packets are dropped (which could be due to invalid packet input). TCP assumes packet losses are due to congestion, while packets lost over 802.11 links are typically dropped due to noise or collisions on the link. If TCP makes a congestion response, it takes the wrong action in response to a collision event. Adversaries may be able to use what appear to be acceptable individual behaviors of the protocols in concert to achieve adverse effects through suitable construction of invalid input. The invalid inputs are those related to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(4)

SI-10(4) Information Input Validation | Timing Interactions
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

Account for timing interactions among system components in determining appropriate responses for invalid inputs.
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(5) > Discussion

SI-10(5) Restrict Inputs to Trusted Sources and Approved Formats - Discussion
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

Restricting the use of inputs to trusted sources and in trusted formats applies the concept of authorized or permitted software to information inputs. Specifying known trusted sources for information inputs and acceptable formats for such inputs can reduce the probability of malicious activity. The information inputs are those defined by the organization in the base control ( [SI-10](#si-10)).
Security and Privacy Controls for Information Systems and Organizations
SI > SI-10 > SI-10(5)

SI-10(5) Information Input Validation | Restrict Inputs to Trusted Sources and Approved Formats
Family: System and Information Integrity (SI) > SI-10 Information Input Validation

Restrict the use of information inputs to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].