ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
IA > IA-9

IA-9 Service Identification and Authentication
Family: Identification and Authentication (IA)

Uniquely identify and authenticate [Assignment: organization-defined system services and applications] before establishing communications with devices, users, or other services or applications.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-9 > Discussion

IA-9 Service Identification and Authentication - Discussion
Family: Identification and Authentication (IA)

Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-10

IA-10 Adaptive Authentication
Family: Identification and Authentication (IA)

Require individuals accessing the system to employ [Assignment: organization-defined supplemental authentication techniques or mechanisms] under specific [Assignment: organization-defined circumstances or situations].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-10 > Discussion

IA-10 Adaptive Authentication - Discussion
Family: Identification and Authentication (IA)

Adversaries may compromise individual authentication mechanisms employed by organizations and subsequently attempt to impersonate legitimate users. To address this threat, organizations may employ specific techniques or mechanisms and establish protocols to assess suspicious behavior. Suspicious behavior may include accessing information that individuals do not typically access as part of their duties, roles, or responsibilities; accessing greater quantities of information than individuals would routinely access; or attempting to access information from suspicious network addresses. When pre-established conditions or triggers occur, organizations can require individuals to provide additional authentication information. Another potential use for adaptive authentication is to increase the strength of mechanism based on the number or types of records being accessed. Adaptive authentication does not replace and is not used to avoid the use of multi-factor authentication mechanisms but can augment implementations of multi-factor authentication.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-11

IA-11 Re-authentication
Family: Identification and Authentication (IA)

Require users to re-authenticate when [Assignment: organization-defined circumstances or situations].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-11 > Discussion

IA-11 Re-authentication - Discussion
Family: Identification and Authentication (IA)

In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12

IA-12 Identity Proofing
Family: Identification and Authentication (IA)

a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
b. Resolve user identities to a unique individual; and
c. Collect, validate, and verify identity evidence.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > Discussion

IA-12 Identity Proofing - Discussion
Family: Identification and Authentication (IA)

Identity proofing is the process of collecting, validating, and verifying a user's identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(1) > Discussion

IA-12(1) Supervisor Authorization - Discussion
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Including supervisor or sponsor authorization as part of the registration process provides an additional level of scrutiny to ensure that the user's management chain is aware of the account, the account is essential to carry out organizational missions and functions, and the user's privileges are appropriate for the anticipated responsibilities and authorities within the organization.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(1)

IA-12(1) Identity Proofing | Supervisor Authorization
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(2) > Discussion

IA-12(2) Identity Evidence - Discussion
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Identity evidence, such as documentary evidence or a combination of documents and biometrics, reduces the likelihood of individuals using fraudulent identification to establish an identity or at least increases the work factor of potential adversaries. The forms of acceptable evidence are consistent with the risks to the systems, roles, and privileges associated with the user's account.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(2)

IA-12(2) Identity Proofing | Identity Evidence
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Require evidence of individual identification be presented to the registration authority.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(3) > Discussion

IA-12(3) Identity Evidence Validation and Verification - Discussion
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Validation and verification of identity evidence increases the assurance that accounts and identifiers are being established for the correct user and authenticators are being bound to that user. Validation refers to the process of confirming that the evidence is genuine and authentic, and the data contained in the evidence is correct, current, and related to an individual. Verification confirms and establishes a linkage between the claimed identity and the actual existence of the user presenting the evidence. Acceptable methods for validating and verifying identity evidence are consistent with the risks to the systems, roles, and privileges associated with the users account.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(3)

IA-12(3) Identity Proofing | Identity Evidence Validation and Verification
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Require that the presented identity evidence be validated and verified through [Assignment: organization-defined methods of validation and verification].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(4) > Discussion

IA-12(4) In-person Validation and Verification - Discussion
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

In-person proofing reduces the likelihood of fraudulent credentials being issued because it requires the physical presence of individuals, the presentation of physical identity documents, and actual face-to-face interactions with designated registration authorities.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(4)

IA-12(4) Identity Proofing | In-person Validation and Verification
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(5) > Discussion

IA-12(5) Address Confirmation - Discussion
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

To make it more difficult for adversaries to pose as legitimate users during the identity proofing process, organizations can use out-of-band methods to ensure that the individual associated with an address of record is the same individual that participated in the registration. Confirmation can take the form of a temporary enrollment code or a notice of proofing. The delivery address for these artifacts is obtained from records and not self-asserted by the user. The address can include a physical or digital address. A home address is an example of a physical address. Email addresses and telephone numbers are examples of digital addresses.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(5)

IA-12(5) Identity Proofing | Address Confirmation
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(6) > Discussion

IA-12(6) Accept Externally-proofed Identities - Discussion
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

To limit unnecessary re-proofing of identities, particularly of non-PIV users, organizations accept proofing conducted at a commensurate level of assurance by other agencies or organizations. Proofing is consistent with organizational security policy and the identity assurance level appropriate for the system, application, or information accessed. Accepting externally-proofed identities is a fundamental component of managing federated identities across agencies and organizations.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-12 > IA-12(6)

IA-12(6) Identity Proofing | Accept Externally-proofed Identities
Family: Identification and Authentication (IA) > IA-12 Identity Proofing

Accept externally-proofed identities at [Assignment: organization-defined identity assurance level].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13

IA-13 Identity Providers and Authorization Servers
Family: Identification and Authentication (IA)

Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignment: organization-defined policy] using [Assignment: organization-defined mechanisms].
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13 > Discussion

IA-13 Identity Providers and Authorization Servers - Discussion
Family: Identification and Authentication (IA)

Identity providers, both internal and external to the organization, manage the user, device, and NPE authenticators and issue statements, often called identity assertions, attesting to identities of other systems or systems components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to system or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions. Authenticator management (to include credential management) is covered by IA-05.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13 > IA-13(1) > Discussion

IA-13(1) Protection of Cryptographic Keys - Discussion
Family: Identification and Authentication (IA) > IA-13 Identity Providers and Authorization Servers

Identity assertions and access tokens are typically digitally signed. The private keys used to sign these assertions and tokens are protected commensurate with the impact of the system and information resources that can be accessed.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13 > IA-13(1)

IA-13(1) Identity Providers and Authorization Servers | Protection of Cryptographic Keys
Family: Identification and Authentication (IA) > IA-13 Identity Providers and Authorization Servers

Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13 > IA-13(2) > Discussion

IA-13(2) Verification of Identity Assertions and Access Tokens - Discussion
Family: Identification and Authentication (IA) > IA-13 Identity Providers and Authorization Servers

This includes verification of digital signatures protecting identity assertions and access tokens, as well as included metadata. Metadata includes information about the access request such as information unique to user, system or information resource being accessed, or the transaction itself such as time. Protected system and information resources could include connected networks, applications, and APIs.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13 > IA-13(2)

IA-13(2) Identity Providers and Authorization Servers | Verification of Identity Assertions and Access Tokens
Family: Identification and Authentication (IA) > IA-13 Identity Providers and Authorization Servers

The source and integrity of identity assertions and access tokens are verified before granting access to system and information resources.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13 > IA-13(3) > Discussion

IA-13(3) Token Management - Discussion
Family: Identification and Authentication (IA) > IA-13 Identity Providers and Authorization Servers

An access token is a piece of data that represents the authorization granted to a user or NPE to access specific systems or information resources. Access tokens enable controlled access to services and resources. Properly managing the lifecycle of access tokens, including their issuance, validation, and revocation, is crucial to maintaining confidentiality of data and systems. Restricting token validity to a specific audience, e.g., an application or security domain, and restricting token validity lifetimes are important practices. Access tokens are revoked or invalidated if they are compromised, lost, or are no longer needed to mitigate the risks associated with stolen or misused tokens.
Security and Privacy Controls for Information Systems and Organizations
IA > IA-13 > IA-13(3)

IA-13(3) Identity Providers and Authorization Servers | Token Management
Family: Identification and Authentication (IA) > IA-13 Identity Providers and Authorization Servers

In accordance with [Assignment: organization-defined policy], assertions and access tokens are:
(a) generated;
(b) issued;
(c) refreshed;
(d) revoked;
(e) time-restricted; and
(f) audience-restricted.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-1

IR-1 Policy and Procedures
Family: Incident Response (IR)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] incident response policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the incident response policy and procedures; and
c. Review and update the current incident response:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-1 > Discussion

IR-1 Policy and Procedures - Discussion
Family: Incident Response (IR)

Incident response policy and procedures address the controls in the IR family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of incident response policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to incident response policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2

IR-2 Incident Response Training
Family: Incident Response (IR)

a. Provide incident response training to system users consistent with assigned roles and responsibilities:
1. Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access;
2. When required by system changes; and
3. [Assignment: organization-defined frequency] thereafter; and
b. Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2 > Discussion

IR-2 Incident Response Training - Discussion
Family: Incident Response (IR)

Incident response training is associated with the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail are included in such training. For example, users may only need to know who to call or how to recognize an incident; system administrators may require additional training on how to handle incidents; and incident responders may receive more specific training on forensics, data collection techniques, reporting, system recovery, and system restoration. Incident response training includes user training in identifying and reporting suspicious activities from external and internal sources. Incident response training for users may be provided as part of [AT-2](#at-2) or [AT-3](#at-3) . Events that may precipitate an update to incident response training content include, but are not limited to, incident response plan testing or response to an actual incident (lessons learned), assessment or audit findings, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2 > IR-2(1) > Discussion

IR-2(1) Simulated Events - Discussion
Family: Incident Response (IR) > IR-2 Incident Response Training

Organizations establish requirements for responding to incidents in incident response plans. Incorporating simulated events into incident response training helps to ensure that personnel understand their individual responsibilities and what specific actions to take in crisis situations.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2 > IR-2(1)

IR-2(1) Incident Response Training | Simulated Events
Family: Incident Response (IR) > IR-2 Incident Response Training

Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2 > IR-2(2) > Discussion

IR-2(2) Automated Training Environments - Discussion
Family: Incident Response (IR) > IR-2 Incident Response Training

Automated mechanisms can provide a more thorough and realistic incident response training environment. This can be accomplished, for example, by providing more complete coverage of incident response issues, selecting more realistic training scenarios and environments, and stressing the response capability.
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2 > IR-2(2)

IR-2(2) Incident Response Training | Automated Training Environments
Family: Incident Response (IR) > IR-2 Incident Response Training

Provide an incident response training environment using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2 > IR-2(3) > Discussion

IR-2(3) Breach - Discussion
Family: Incident Response (IR) > IR-2 Incident Response Training

For federal agencies, an incident that involves personally identifiable information is considered a breach. A breach results in the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or a similar occurrence where a person other than an authorized user accesses or potentially accesses personally identifiable information or an authorized user accesses or potentially accesses such information for other than authorized purposes. The incident response training emphasizes the obligation of individuals to report both confirmed and suspected breaches involving information in any medium or form, including paper, oral, and electronic. Incident response training includes tabletop exercises that simulate a breach. See [IR-2(1)](#ir-2.1).
Security and Privacy Controls for Information Systems and Organizations
IR > IR-2 > IR-2(3)

IR-2(3) Incident Response Training | Breach
Family: Incident Response (IR) > IR-2 Incident Response Training

Provide incident response training on how to identify and respond to a breach, including the organization's process for reporting a breach.