ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-9 > Assessment Objective

CA-9 Internal System Connections - Assessment Objective
Determine if the following are satisfied:

CA-09a. internal connections of [Assignment: organization-defined system components] to the system are authorized;
CA-09b.[01] for each internal connection, the interface characteristics are documented;
CA-09b.[02] for each internal connection, the security requirements are documented;
CA-09b.[03] for each internal connection, the privacy requirements are documented;
CA-09b.[04] for each internal connection, the nature of the information communicated is documented;
CA-09c. internal system connections are terminated after [Assignment: organization-defined conditions];
CA-09d. the continued need for each internal connection is reviewed [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-9 > CA-9(1) > Assessment Methods

CA-9(1) Compliance Checks - Assessment Methods and Objects

Examine: Assessment, authorization, and monitoring policy

access control policy

procedures addressing system connections

system and communications protection policy

system design documentation

system configuration settings and associated documentation

list of components or classes of components authorized as internal system connections

assessment report

system audit records

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections

organizational personnel with information security and privacy responsibilities

Test: Mechanisms supporting compliance checks
Assessing Security and Privacy Controls in Information Systems and Organizations
CA > CA-9 > CA-9(1) > Assessment Objective

CA-9(1) Compliance Checks - Assessment Objective
Determine if the following are satisfied:

CA-09(01)[01] security compliance checks are performed on constituent system components prior to the establishment of the internal connection;
CA-09(01)[02] privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-1 > Assessment Methods

CM-1 Policy and Procedures - Assessment Methods and Objects

Examine: Configuration management policy and procedures

security and privacy program policies and procedures

assessment or audit findings

documentation of security incidents or breaches

system security plan

privacy plan

risk management strategy

other relevant artifacts, documents, or records

Interview: Organizational personnel with configuration management responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-1 > Assessment Objective

CM-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

CM-01a.[01] a configuration management policy is developed and documented;
CM-01a.[02] the configuration management policy is disseminated to [Assignment: organization-defined personnel or roles];
CM-01a.[03] configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented;
CM-01a.[04] the configuration management procedures are disseminated to [Assignment: organization-defined personnel or roles];
CM-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the configuration management policy addresses purpose;
CM-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the configuration management policy addresses scope;
CM-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the configuration management policy addresses roles;
CM-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the configuration management policy addresses responsibilities;
CM-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the configuration management policy addresses management commitment;
CM-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the configuration management policy addresses coordination among organizational entities;
CM-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] of the configuration management policy addresses compliance;
CM-01a.01(b) the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
CM-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures;
CM-01c.01[01] the current configuration management policy is reviewed and updated [Assignment: organization-defined frequency];
CM-01c.01[02] the current configuration management policy is reviewed and updated following [Assignment: organization-defined events];
CM-01c.02[01] the current configuration management procedures are reviewed and updated [Assignment: organization-defined frequency];
CM-01c.02[02] the current configuration management procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > Assessment Methods

CM-2 Baseline Configuration - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing the baseline configuration of the system

configuration management plan

enterprise architecture documentation

system design documentation

system security plan

privacy plan

system architecture and configuration documentation

system configuration settings and associated documentation

system component inventory

change control records

other relevant documents or records

Interview: Organizational personnel with configuration management responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Test: Organizational processes for managing baseline configurations

mechanisms supporting configuration control of the baseline configuration
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > Assessment Objective

CM-2 Baseline Configuration - Assessment Objective
Determine if the following are satisfied:

CM-02a.[01] a current baseline configuration of the system is developed and documented;
CM-02a.[02] a current baseline configuration of the system is maintained under configuration control;
CM-02b.01 the baseline configuration of the system is reviewed and updated [Assignment: organization-defined frequency];
CM-02b.02 the baseline configuration of the system is reviewed and updated when required due to [Assignment: organization-defined circumstances];
CM-02b.03 the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(2) > Assessment Methods

CM-2(2) Automation Support for Accuracy and Currency - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing the baseline configuration of the system

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

system component inventory

configuration change control records

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing baseline configurations

automated mechanisms implementing baseline configuration maintenance
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(2) > Assessment Objective

CM-2(2) Automation Support for Accuracy and Currency - Assessment Objective
Determine if the following are satisfied:

CM-02(02)[01] the currency of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms];
CM-02(02)[02] the completeness of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms];
CM-02(02)[03] the accuracy of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms];
CM-02(02)[04] the availability of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(3) > Assessment Methods

CM-2(3) Retention of Previous Configurations - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing the baseline configuration of the system

configuration management plan

system architecture and configuration documentation

system configuration settings and associated documentation

copies of previous baseline configuration versions

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing baseline configurations
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(3) > Assessment Objective

CM-2(3) Retention of Previous Configurations - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined number] of previous baseline configuration version(s) of the system is/are retained to support rollback.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(6) > Assessment Methods

CM-2(6) Development and Test Environments - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing the baseline configuration of the system

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing baseline configurations

mechanisms implementing separate baseline configurations for development, test, and operational environments
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(6) > Assessment Objective

CM-2(6) Development and Test Environments - Assessment Objective
Determine if the following are satisfied:

CM-02(06)[01] a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained;
CM-02(06)[02] a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(7) > Assessment Methods

CM-2(7) Configure Systems and Components for High-risk Areas - Assessment Methods and Objects

Examine: Configuration management policy

configuration management plan

procedures addressing the baseline configuration of the system

procedures addressing system component installations and upgrades

system architecture and configuration documentation

system configuration settings and associated documentation

system component inventory

records of system baseline configuration reviews and updates

system component installations/upgrades and associated records

change control records

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration management responsibilities

organizational personnel with information security responsibilities

system/network administrators

Test: Organizational processes for managing baseline configurations
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-2 > CM-2(7) > Assessment Objective

CM-2(7) Configure Systems and Components for High-risk Areas - Assessment Objective
Determine if the following are satisfied:

CM-02(07)(a) [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] are issued to individuals traveling to locations that the organization deems to be of significant risk;
CM-02(07)(b) [Assignment: organization-defined controls] are applied to the systems or system components when the individuals return from travel.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > Assessment Methods

CM-3 Configuration Change Control - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system configuration change control

configuration management plan

system architecture and configuration documentation

change control records

system audit records

change control audit and review reports

agenda/minutes/documentation from configuration change control oversight meetings

system security plan

privacy plan

privacy impact assessments

system of records notices

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

members of change control board or similar

Test: Organizational processes for configuration change control

mechanisms that implement configuration change control
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > Assessment Objective

CM-3 Configuration Change Control - Assessment Objective
Determine if the following are satisfied:

CM-03a. the types of changes to the system that are configuration-controlled are determined and documented;
CM-03b.[01] proposed configuration-controlled changes to the system are reviewed;
CM-03b.[02] proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;
CM-03c. configuration change decisions associated with the system are documented;
CM-03d. approved configuration-controlled changes to the system are implemented;
CM-03e. records of configuration-controlled changes to the system are retained for [Assignment: organization-defined time period];
CM-03f.[01] activities associated with configuration-controlled changes to the system are monitored;
CM-03f.[02] activities associated with configuration-controlled changes to the system are reviewed;
CM-03g.[01] configuration change control activities are coordinated and overseen by [Assignment: organization-defined configuration change control element];
CM-03g.[02] the configuration control element convenes [Selection; one or more: [Assignment: organization-defined frequency] ; when [Assignment: organization-defined configuration change conditions] ].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(1) > Assessment Methods

CM-3(1) Automated Documentation, Notification, and Prohibition of Changes - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system configuration change control

configuration management plan

system design documentation

system architecture and configuration documentation

automated configuration control mechanisms

system configuration settings and associated documentation

change control records

system audit records

change approval requests

change approvals

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Test: Organizational processes for configuration change control

automated mechanisms implementing configuration change control activities
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(1) > Assessment Objective

CM-3(1) Automated Documentation, Notification, and Prohibition of Changes - Assessment Objective
Determine if the following are satisfied:

CM-03(01)(a) [Assignment: organization-defined automated mechanisms] are used to document proposed changes to the system;
CM-03(01)(b) [Assignment: organization-defined automated mechanisms] are used to notify [Assignment: organization-defined approval authorities] of proposed changes to the system and request change approval;
CM-03(01)(c) [Assignment: organization-defined automated mechanisms] are used to highlight proposed changes to the system that have not been approved or disapproved within [Assignment: organization-defined time period];
CM-03(01)(d) [Assignment: organization-defined automated mechanisms] are used to prohibit changes to the system until designated approvals are received;
CM-03(01)(e) [Assignment: organization-defined automated mechanisms] are used to document all changes to the system;
CM-03(01)(f) [Assignment: organization-defined automated mechanisms] are used to notify [Assignment: organization-defined personnel] when approved changes to the system are completed.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(2) > Assessment Methods

CM-3(2) Testing, Validation, and Documentation of Changes - Assessment Methods and Objects

Examine: Configuration management policy

configuration management plan

procedures addressing system configuration change control

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

test records

validation records

change control records

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Test: Organizational processes for configuration change control

mechanisms supporting and/or implementing, testing, validating, and documenting system changes
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(2) > Assessment Objective

CM-3(2) Testing, Validation, and Documentation of Changes - Assessment Objective
Determine if the following are satisfied:

CM-03(02)[01] changes to the system are tested before finalizing the implementation of the changes;
CM-03(02)[02] changes to the system are validated before finalizing the implementation of the changes;
CM-03(02)[03] changes to the system are documented before finalizing the implementation of the changes.
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(3) > Assessment Methods

CM-3(3) Automated Change Implementation - Assessment Methods and Objects

Examine: Configuration management policy

configuration management plan

procedures addressing system configuration change control

system design documentation

system architecture and configuration documentation

automated configuration control mechanisms

change control records

system component inventory

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Test: Organizational processes for configuration change control

automated mechanisms implementing changes to current system baseline
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(3) > Assessment Objective

CM-3(3) Automated Change Implementation - Assessment Objective
Determine if the following are satisfied:

CM-03(03)[01] changes to the current system baseline are implemented using [Assignment: organization-defined automated mechanisms];
CM-03(03)[02] the updated baseline is deployed across the installed base using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(4) > Assessment Methods

CM-3(4) Security and Privacy Representatives - Assessment Methods and Objects

Examine: Configuration management policy

procedures addressing system configuration change control

configuration management plan

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with information security and privacy responsibilities

members of change control board or similar

Test: Organizational processes for configuration change control
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(4) > Assessment Objective

CM-3(4) Security and Privacy Representatives - Assessment Objective
Determine if the following are satisfied:

CM-03(04)[01] [Assignment: organization-defined security representatives] are required to be members of the [Assignment: organization-defined configuration change control element];
CM-03(04)[02] [Assignment: organization-defined privacy representatives] are required to be members of the [Assignment: organization-defined configuration change control element].
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(5) > Assessment Methods

CM-3(5) Automated Security Response - Assessment Methods and Objects

Examine: System security plan

configuration management policy

procedures addressing system configuration change control

configuration management plan

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

alerts/notifications of unauthorized baseline configuration changes

system audit records

other relevant documents or records

Interview: Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Test: Organizational processes for configuration change control

automated mechanisms implementing security responses to unauthorized changes to the baseline configurations
Assessing Security and Privacy Controls in Information Systems and Organizations
CM > CM-3 > CM-3(5) > Assessment Objective

CM-3(5) Automated Security Response - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined security responses] are automatically implemented if baseline configurations are changed in an unauthorized manner.