ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SC > SC-34 > SC-34(2)

SC-34(2) Non-modifiable Executable Programs | Integrity Protection on Read-only Media
Family: System and Communications Protection (SC) > SC-34 Non-modifiable Executable Programs

Protect the integrity of information prior to storage on read-only media and control the media after such information has been recorded onto the media.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-35

SC-35 External Malicious Code Identification
Family: System and Communications Protection (SC)

Include system components that proactively seek to identify network-based malicious code or malicious websites.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-35 > Discussion

SC-35 External Malicious Code Identification - Discussion
Family: System and Communications Protection (SC)

External malicious code identification differs from decoys in [SC-26](#sc-26) in that the components actively probe networks, including the Internet, in search of malicious code contained on external websites. Like decoys, the use of external malicious code identification techniques requires some supporting isolation measures to ensure that any malicious code discovered during the search and subsequently executed does not infect organizational systems. Virtualization is a common technique for achieving such isolation.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-36

SC-36 Distributed Processing and Storage
Family: System and Communications Protection (SC)

Distribute the following processing and storage components across multiple [Selection: physical locations; logical domains]: [Assignment: organization-defined organization-defined processing and storage components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-36 > Discussion

SC-36 Distributed Processing and Storage - Discussion
Family: System and Communications Protection (SC)

Distributing processing and storage across multiple physical locations or logical domains provides a degree of redundancy or overlap for organizations. The redundancy and overlap increase the work factor of adversaries to adversely impact organizational operations, assets, and individuals. The use of distributed processing and storage does not assume a single primary processing or storage location. Therefore, it allows for parallel processing and storage.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-36 > SC-36(1) > Discussion

SC-36(1) Polling Techniques - Discussion
Family: System and Communications Protection (SC) > SC-36 Distributed Processing and Storage

Distributed processing and/or storage may be used to reduce opportunities for adversaries to compromise the confidentiality, integrity, or availability of organizational information and systems. However, the distribution of processing and storage components does not prevent adversaries from compromising one or more of the components. Polling compares the processing results and/or storage content from the distributed components and subsequently votes on the outcomes. Polling identifies potential faults, compromises, or errors in the distributed processing and storage components.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-36 > SC-36(1)

SC-36(1) Distributed Processing and Storage | Polling Techniques
Family: System and Communications Protection (SC) > SC-36 Distributed Processing and Storage

(a) Employ polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: [Assignment: organization-defined distributed processing and storage components] ; and
(b) Take the following actions in response to identified faults, errors, or compromises: [Assignment: organization-defined actions].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-36 > SC-36(2) > Discussion

SC-36(2) Synchronization - Discussion
Family: System and Communications Protection (SC) > SC-36 Distributed Processing and Storage

[SC-36](#sc-36) and [CP-9(6)](#cp-9.6) require the duplication of systems or system components in distributed locations. The synchronization of duplicated and redundant services and data helps to ensure that information contained in the distributed locations can be used in the mission or business functions of organizations, as needed.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-36 > SC-36(2)

SC-36(2) Distributed Processing and Storage | Synchronization
Family: System and Communications Protection (SC) > SC-36 Distributed Processing and Storage

Synchronize the following duplicate systems or system components: [Assignment: organization-defined duplicate systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-37

SC-37 Out-of-band Channels
Family: System and Communications Protection (SC)

Employ the following out-of-band channels for the physical delivery or electronic transmission of [Assignment: organization-defined information, system components, or devices] to [Assignment: organization-defined individuals or systems]: [Assignment: organization-defined out-of-band channels].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-37 > Discussion

SC-37 Out-of-band Channels - Discussion
Family: System and Communications Protection (SC)

Out-of-band channels include local, non-network accesses to systems; network paths physically separate from network paths used for operational traffic; or non-electronic paths, such as the U.S. Postal Service. The use of out-of-band channels is contrasted with the use of in-band channels (i.e., the same channels) that carry routine operational traffic. Out-of-band channels do not have the same vulnerability or exposure as in-band channels. Therefore, the confidentiality, integrity, or availability compromises of in-band channels will not compromise or adversely affect the out-of-band channels. Organizations may employ out-of-band channels in the delivery or transmission of organizational items, including authenticators and credentials; cryptographic key management information; system and data backups; configuration management changes for hardware, firmware, or software; security updates; maintenance information; and malicious code protection updates. For example, cryptographic keys for encrypted files are delivered using a different channel than the file.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-37 > SC-37(1) > Discussion

SC-37(1) Ensure Delivery and Transmission - Discussion
Family: System and Communications Protection (SC) > SC-37 Out-of-band Channels

Techniques employed by organizations to ensure that only designated systems or individuals receive certain information, system components, or devices include sending authenticators via an approved courier service but requiring recipients to show some form of government-issued photographic identification as a condition of receipt.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-37 > SC-37(1)

SC-37(1) Out-of-band Channels | Ensure Delivery and Transmission
Family: System and Communications Protection (SC) > SC-37 Out-of-band Channels

Employ [Assignment: organization-defined controls] to ensure that only [Assignment: organization-defined individuals or systems] receive the following information, system components, or devices: [Assignment: organization-defined information, system components, or devices].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-38

SC-38 Operations Security
Family: System and Communications Protection (SC)

Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [Assignment: organization-defined operations security controls].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-38 > Discussion

SC-38 Operations Security - Discussion
Family: System and Communications Protection (SC)

Operations security (OPSEC) is a systematic process by which potential adversaries can be denied information about the capabilities and intentions of organizations by identifying, controlling, and protecting generally unclassified information that specifically relates to the planning and execution of sensitive organizational activities. The OPSEC process involves five steps: identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risks, and the application of appropriate countermeasures. OPSEC controls are applied to organizational systems and the environments in which those systems operate. OPSEC controls protect the confidentiality of information, including limiting the sharing of information with suppliers, potential suppliers, and other non-organizational elements and individuals. Information critical to organizational mission and business functions includes user identities, element uses, suppliers, supply chain processes, functional requirements, security requirements, system design specifications, testing and evaluation protocols, and security control implementation details.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-39

SC-39 Process Isolation
Family: System and Communications Protection (SC)

Maintain a separate execution domain for each executing system process.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-39 > Discussion

SC-39 Process Isolation - Discussion
Family: System and Communications Protection (SC)

Systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. Process isolation technologies, including sandboxing or virtualization, logically separate software and firmware from other software, firmware, and data. Process isolation helps limit the access of potentially untrusted software to other system resources. The capability to maintain separate execution domains is available in commercial operating systems that employ multi-state processor technologies.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-39 > SC-39(1) > Discussion

SC-39(1) Hardware Separation - Discussion
Family: System and Communications Protection (SC) > SC-39 Process Isolation

Hardware-based separation of system processes is generally less susceptible to compromise than software-based separation, thus providing greater assurance that the separation will be enforced. Hardware separation mechanisms include hardware memory management.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-39 > SC-39(1)

SC-39(1) Process Isolation | Hardware Separation
Family: System and Communications Protection (SC) > SC-39 Process Isolation

Implement hardware separation mechanisms to facilitate process isolation.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-39 > SC-39(2)

SC-39(2) Process Isolation | Separate Execution Domain Per Thread
Family: System and Communications Protection (SC) > SC-39 Process Isolation

Maintain a separate execution domain for each thread in [Assignment: organization-defined multi-threaded processing].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40

SC-40 Wireless Link Protection
Family: System and Communications Protection (SC)

Protect external and internal [Assignment: organization-defined organization-defined wireless links] from the following signal parameter attacks: [Assignment: organization-defined organization-defined types of signal parameter attacks or references to sources for such attacks].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > Discussion

SC-40 Wireless Link Protection - Discussion
Family: System and Communications Protection (SC)

Wireless link protection applies to internal and external wireless communication links that may be visible to individuals who are not authorized system users. Adversaries can exploit the signal parameters of wireless links if such links are not adequately protected. There are many ways to exploit the signal parameters of wireless links to gain intelligence, deny service, or spoof system users. Protection of wireless links reduces the impact of attacks that are unique to wireless systems. If organizations rely on commercial service providers for transmission services as commodity items rather than as fully dedicated services, it may not be possible to implement wireless link protections to the extent necessary to meet organizational security requirements.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(1) > Discussion

SC-40(1) Electromagnetic Interference - Discussion
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

The implementation of cryptographic mechanisms for electromagnetic interference protects systems against intentional jamming that might deny or impair communications by ensuring that wireless spread spectrum waveforms used to provide anti-jam protection are not predictable by unauthorized individuals. The implementation of cryptographic mechanisms may also coincidentally mitigate the effects of unintentional jamming due to interference from legitimate transmitters that share the same spectrum. Mission requirements, projected threats, concept of operations, and laws, executive orders, directives, regulations, policies, and standards determine levels of wireless link availability, cryptography needed, and performance.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(1)

SC-40(1) Wireless Link Protection | Electromagnetic Interference
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

Implement cryptographic mechanisms that achieve [Assignment: organization-defined level of protection] against the effects of intentional electromagnetic interference.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(2) > Discussion

SC-40(2) Reduce Detection Potential - Discussion
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

The implementation of cryptographic mechanisms to reduce detection potential is used for covert communications and to protect wireless transmitters from geo-location. It also ensures that the spread spectrum waveforms used to achieve a low probability of detection are not predictable by unauthorized individuals. Mission requirements, projected threats, concept of operations, and applicable laws, executive orders, directives, regulations, policies, and standards determine the levels to which wireless links are undetectable.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(2)

SC-40(2) Wireless Link Protection | Reduce Detection Potential
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

Implement cryptographic mechanisms to reduce the detection potential of wireless links to [Assignment: organization-defined level of reduction].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(3) > Discussion

SC-40(3) Imitative or Manipulative Communications Deception - Discussion
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

The implementation of cryptographic mechanisms to identify and reject imitative or manipulative communications ensures that the signal parameters of wireless transmissions are not predictable by unauthorized individuals. Such unpredictability reduces the probability of imitative or manipulative communications deception based on signal parameters alone.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(3)

SC-40(3) Wireless Link Protection | Imitative or Manipulative Communications Deception
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(4) > Discussion

SC-40(4) Signal Parameter Identification - Discussion
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

The implementation of cryptographic mechanisms to prevent the identification of wireless transmitters protects against the unique identification of wireless transmitters for the purposes of intelligence exploitation by ensuring that anti-fingerprinting alterations to signal parameters are not predictable by unauthorized individuals. It also provides anonymity when required. Radio fingerprinting techniques identify the unique signal parameters of transmitters to fingerprint such transmitters for purposes of tracking and mission or user identification.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-40 > SC-40(4)

SC-40(4) Wireless Link Protection | Signal Parameter Identification
Family: System and Communications Protection (SC) > SC-40 Wireless Link Protection

Implement cryptographic mechanisms to prevent the identification of [Assignment: organization-defined wireless transmitters] by using the transmitter signal parameters.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-41

SC-41 Port and I/O Device Access
Family: System and Communications Protection (SC)

[Selection: physically; logically] disable or remove [Assignment: organization-defined connection ports or input/output devices] on the following systems or system components: [Assignment: organization-defined systems or system components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-41 > Discussion

SC-41 Port and I/O Device Access - Discussion
Family: System and Communications Protection (SC)

Connection ports include Universal Serial Bus (USB), Thunderbolt, and Firewire (IEEE 1394). Input/output (I/O) devices include compact disc and digital versatile disc drives. Disabling or removing such connection ports and I/O devices helps prevent the exfiltration of information from systems and the introduction of malicious code from those ports or devices. Physically disabling or removing ports and/or devices is the stronger action.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42

SC-42 Sensor Capability and Data
Family: System and Communications Protection (SC)

a. Prohibit [Selection; one or more: the use of devices possessing [Assignment: organization-defined environmental sensing capabilities] in [Assignment: organization-defined facilities, areas, or systems] ; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [Assignment: organization-defined exceptions where remote activation of sensors is allowed] ] ; and
b. Provide an explicit indication of sensor use to [Assignment: organization-defined group of users].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > Discussion

SC-42 Sensor Capability and Data - Discussion
Family: System and Communications Protection (SC)

Sensor capability and data applies to types of systems or system components characterized as mobile devices, such as cellular telephones, smart phones, and tablets. Mobile devices often include sensors that can collect and record data regarding the environment where the system is in use. Sensors that are embedded within mobile devices include microphones, cameras, Global Positioning System (GPS) mechanisms, and accelerometers. While the sensors on mobiles devices provide an important function, if activated covertly, such devices can potentially provide a means for adversaries to learn valuable information about individuals and organizations. For example, remotely activating the GPS function on a mobile device could provide an adversary with the ability to track the movements of an individual. Organizations may prohibit individuals from bringing cellular telephones or digital cameras into certain designated facilities or controlled areas within facilities where classified information is stored or sensitive conversations are taking place.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(1) > Discussion

SC-42(1) Reporting to Authorized Individuals or Roles - Discussion
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

In situations where sensors are activated by authorized individuals, it is still possible that the data or information collected by the sensors will be sent to unauthorized entities.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(1)

SC-42(1) Sensor Capability and Data | Reporting to Authorized Individuals or Roles
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

Verify that the system is configured so that data or information collected by the [Assignment: organization-defined sensors] is only reported to authorized individuals or roles.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(2) > Discussion

SC-42(2) Authorized Use - Discussion
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

Information collected by sensors for a specific authorized purpose could be misused for some unauthorized purpose. For example, GPS sensors that are used to support traffic navigation could be misused to track the movements of individuals. Measures to mitigate such activities include additional training to help ensure that authorized individuals do not abuse their authority and, in the case where sensor data is maintained by external parties, contractual restrictions on the use of such data.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(2)

SC-42(2) Sensor Capability and Data | Authorized Use
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

Employ the following measures so that data or information collected by [Assignment: organization-defined sensors] is only used for authorized purposes: [Assignment: organization-defined measures].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(4) > Discussion

SC-42(4) Notice of Collection - Discussion
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

Awareness that organizational sensors are collecting data enables individuals to more effectively engage in managing their privacy. Measures can include conventional written notices and sensor configurations that make individuals directly or indirectly aware through other devices that the sensor is collecting information. The usability and efficacy of the notice are important considerations.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-42 > SC-42(4)

SC-42(4) Sensor Capability and Data | Notice of Collection
Family: System and Communications Protection (SC) > SC-42 Sensor Capability and Data

Employ the following measures to facilitate an individual's awareness that personally identifiable information is being collected by [Assignment: organization-defined sensors]: [Assignment: organization-defined measures].