ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(8) > Assessment Methods

AC-6(8) Privilege Levels for Code Execution - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

list of software that should not execute at higher privilege levels than users executing software

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms implementing least privilege functions for software execution
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(8) > Assessment Objective

AC-6(8) Privilege Levels for Code Execution - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined software] is prevented from executing at higher privilege levels than users executing the software.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(9) > Assessment Methods

AC-6(9) Log Use of Privileged Functions - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

system design documentation

system configuration settings and associated documentation

list of privileged functions to be audited

list of audited events

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

system developers

Test: Mechanisms auditing the execution of least privilege functions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(9) > Assessment Objective

AC-6(9) Log Use of Privileged Functions - Assessment Objective
Determine if the following are satisfied:

the execution of privileged functions is logged.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(10) > Assessment Methods

AC-6(10) Prohibit Non-privileged Users from Executing Privileged Functions - Assessment Methods and Objects

Examine: Access control policy

procedures addressing least privilege

system design documentation

system configuration settings and associated documentation

list of privileged functions and associated user account assignments

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing least privilege functions for non-privileged users
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-6 > AC-6(10) > Assessment Objective

AC-6(10) Prohibit Non-privileged Users from Executing Privileged Functions - Assessment Objective
Determine if the following are satisfied:

non-privileged users are prevented from executing privileged functions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > Assessment Methods

AC-7 Unsuccessful Logon Attempts - Assessment Methods and Objects

Examine: Access control policy

procedures addressing unsuccessful logon attempts

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: Organizational personnel with information security responsibilities

system developers

system/network administrators

Test: Mechanisms implementing access control policy for unsuccessful logon attempts
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > Assessment Objective

AC-7 Unsuccessful Logon Attempts - Assessment Objective
Determine if the following are satisfied:

AC-07a. a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during [Assignment: organization-defined time period] is enforced;
AC-07b. automatically [Selection; one or more: lock the account or node for [Assignment: organization-defined time period] ; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm] ; notify system administrator; take other [Assignment: organization-defined action] ] when the maximum number of unsuccessful attempts is exceeded.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > AC-7(2) > Assessment Methods

AC-7(2) Purge or Wipe Mobile Device - Assessment Methods and Objects

Examine: Access control policy

procedures addressing unsuccessful logon attempts on mobile devices

system design documentation

system configuration settings and associated documentation

list of mobile devices to be purged/wiped after organization-defined consecutive, unsuccessful device logon attempts

list of purging/wiping requirements or techniques for mobile devices

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing access control policy for unsuccessful device logon attempts
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > AC-7(2) > Assessment Objective

AC-7(2) Purge or Wipe Mobile Device - Assessment Objective
Determine if the following are satisfied:

information is purged or wiped from [Assignment: organization-defined mobile devices] based on [Assignment: organization-defined purging or wiping requirements and techniques] after [Assignment: organization-defined number] consecutive, unsuccessful device logon attempts.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > AC-7(3) > Assessment Methods

AC-7(3) Biometric Attempt Limiting - Assessment Methods and Objects

Examine: Access control policy

procedures addressing unsuccessful logon attempts on biometric devices

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing access control policy for unsuccessful logon attempts
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > AC-7(3) > Assessment Objective

AC-7(3) Biometric Attempt Limiting - Assessment Objective
Determine if the following are satisfied:

unsuccessful biometric logon attempts are limited to [Assignment: organization-defined number].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > AC-7(4) > Assessment Methods

AC-7(4) Use of Alternate Authentication Factor - Assessment Methods and Objects

Examine: Access control policy

procedures addressing unsuccessful logon attempts for primary and alternate authentication factors

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

Test: Mechanisms implementing access control policy for unsuccessful logon attempts
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-7 > AC-7(4) > Assessment Objective

AC-7(4) Use of Alternate Authentication Factor - Assessment Objective
Determine if the following are satisfied:

AC-07(04)(a) [Assignment: organization-defined authentication factors] that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded;
AC-07(04)(b) a limit of [Assignment: organization-defined number] consecutive invalid logon attempts through the use of the alternative factors by the user during a [Assignment: organization-defined time period] is enforced.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-8 > Assessment Methods

AC-8 System Use Notification - Assessment Methods and Objects

Examine: Access control policy

privacy and security policies, procedures addressing system use notification

documented approval of system use notification messages or banners

system audit records

user acknowledgements of notification message or banner

system design documentation

system configuration settings and associated documentation

system use notification messages

system security plan

privacy plan

privacy impact assessment

privacy assessment report

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

legal counsel

system developers

Test: Mechanisms implementing system use notification
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-8 > Assessment Objective

AC-8 System Use Notification - Assessment Objective
Determine if the following are satisfied:

AC-08a. [Assignment: organization-defined system use notification] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
AC-08a.01 the system use notification states that users are accessing a U.S. Government system;
AC-08a.02 the system use notification states that system usage may be monitored, recorded, and subject to audit;
AC-08a.03 the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
AC-08a.04 the system use notification states that use of the system indicates consent to monitoring and recording;
AC-08b. the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system;
AC-08c.01 for publicly accessible systems, system use information [Assignment: organization-defined conditions] is displayed before granting further access to the publicly accessible system;
AC-08c.02 for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed;
AC-08c.03 for publicly accessible systems, a description of the authorized uses of the system is included.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > Assessment Methods

AC-9 Previous Logon Notification - Assessment Methods and Objects

Examine: Access control policy

procedures addressing previous logon notification

system design documentation

system configuration settings and associated documentation

system notification messages

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access control policy for previous logon notification
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > Assessment Objective

AC-9 Previous Logon Notification - Assessment Objective
Determine if the following are satisfied:

the user is notified, upon successful logon to the system, of the date and time of the last logon.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(1) > Assessment Methods

AC-9(1) Unsuccessful Logons - Assessment Methods and Objects

Examine: Access control policy

procedures addressing previous logon notification

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access control policy for previous logon notification
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(1) > Assessment Objective

AC-9(1) Unsuccessful Logons - Assessment Objective
Determine if the following are satisfied:

the user is notified, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(2) > Assessment Methods

AC-9(2) Successful and Unsuccessful Logons - Assessment Methods and Objects

Examine: Access control policy

procedures addressing previous logon notification

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access control policy for previous logon notification
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(2) > Assessment Objective

AC-9(2) Successful and Unsuccessful Logons - Assessment Objective
Determine if the following are satisfied:

the user is notified, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(3) > Assessment Methods

AC-9(3) Notification of Account Changes - Assessment Methods and Objects

Examine: Access control policy

procedures addressing previous logon notification

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access control policy for previous logon notification
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(3) > Assessment Objective

AC-9(3) Notification of Account Changes - Assessment Objective
Determine if the following are satisfied:

the user is notified, upon successful logon, of changes to [Assignment: organization-defined security-related characteristics or parameters] during [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(4) > Assessment Methods

AC-9(4) Additional Logon Information - Assessment Methods and Objects

Examine: Access control policy

procedures addressing previous logon notification

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access control policy for previous logon notification
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-9 > AC-9(4) > Assessment Objective

AC-9(4) Additional Logon Information - Assessment Objective
Determine if the following are satisfied:

the user is notified, upon successful logon, of [Assignment: organization-defined additional information].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-10 > Assessment Methods

AC-10 Concurrent Session Control - Assessment Methods and Objects

Examine: Access control policy

procedures addressing concurrent session control

system design documentation

system configuration settings and associated documentation

security plan

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access control policy for concurrent session control
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-10 > Assessment Objective

AC-10 Concurrent Session Control - Assessment Objective
Determine if the following are satisfied:

the number of concurrent sessions for each [Assignment: organization-defined account and/or account types] is limited to [Assignment: organization-defined number].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-11 > Assessment Methods

AC-11 Device Lock - Assessment Methods and Objects

Examine: Access control policy

procedures addressing session lock

procedures addressing identification and authentication

system design documentation

system configuration settings and associated documentation

security plan

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Mechanisms implementing access control policy for session lock
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-11 > Assessment Objective

AC-11 Device Lock - Assessment Objective
Determine if the following are satisfied:

AC-11a. further access to the system is prevented by [Selection; one or more: initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended];
AC-11b. device lock is retained until the user re-establishes access using established identification and authentication procedures.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-11 > AC-11(1) > Assessment Methods

AC-11(1) Pattern-hiding Displays - Assessment Methods and Objects

Examine: Access control policy

procedures addressing session lock

display screen with session lock activated

system design documentation

system configuration settings and associated documentation

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: System session lock mechanisms
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-11 > AC-11(1) > Assessment Objective

AC-11(1) Pattern-hiding Displays - Assessment Objective
Determine if the following are satisfied:

information previously visible on the display is concealed, via device lock, with a publicly viewable image.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > Assessment Methods

AC-12 Session Termination - Assessment Methods and Objects

Examine: Access control policy

procedures addressing session termination

system design documentation

system configuration settings and associated documentation

list of conditions or trigger events requiring session disconnect

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: Automated mechanisms implementing user session termination
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > Assessment Objective

AC-12 Session Termination - Assessment Objective
Determine if the following are satisfied:

a user session is automatically terminated after [Assignment: organization-defined conditions or trigger events].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > AC-12(1) > Assessment Methods

AC-12(1) User-initiated Logouts - Assessment Methods and Objects

Examine: Access control policy

procedures addressing session termination

user logout messages

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: System session termination mechanisms

logout capabilities for user-initiated communications sessions
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > AC-12(1) > Assessment Objective

AC-12(1) User-initiated Logouts - Assessment Objective
Determine if the following are satisfied:

a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > AC-12(2) > Assessment Methods

AC-12(2) Termination Message - Assessment Methods and Objects

Examine: Access control policy

procedures addressing session termination

user logout messages

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: System session termination mechanisms

display of logout messages
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > AC-12(2) > Assessment Objective

AC-12(2) Termination Message - Assessment Objective
Determine if the following are satisfied:

an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > AC-12(3) > Assessment Methods

AC-12(3) Timeout Warning Message - Assessment Methods and Objects

Examine: Access control policy

procedures addressing session termination

time until end of session messages

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

Test: System session termination mechanisms

display of end of session time
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-12 > AC-12(3) > Assessment Objective

AC-12(3) Timeout Warning Message - Assessment Objective
Determine if the following are satisfied:

an explicit message to users is displayed indicating that the session will end in [Assignment: organization-defined time].
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-14 > Assessment Methods

AC-14 Permitted Actions Without Identification or Authentication - Assessment Methods and Objects

Examine: Access control policy

procedures addressing permitted actions without identification or authentication

system configuration settings and associated documentation

security plan

list of user actions that can be performed without identification or authentication

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities