ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
SC > SC-51 > Assessment Objective

SC-51 Hardware-based Protection - Assessment Objective
Determine if the following are satisfied:

SC-51a. hardware-based write-protect for [Assignment: organization-defined system firmware components] is employed;
SC-51b.[01] specific procedures are implemented for [Assignment: organization-defined authorized individuals] to manually disable hardware write-protect for firmware modifications;
SC-51b.[02] specific procedures are implemented for [Assignment: organization-defined authorized individuals] to re-enable the write-protect prior to returning to operational mode.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-1 > Assessment Methods

SI-1 Policy and Procedures - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with system and information integrity responsibilities

organizational personnel with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-1 > Assessment Objective

SI-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

SI-01a.[01] a system and information integrity policy is developed and documented;
SI-01a.[02] the system and information integrity policy is disseminated to [Assignment: organization-defined personnel or roles];
SI-01a.[03] system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented;
SI-01a.[04] the system and information integrity procedures are disseminated to [Assignment: organization-defined personnel or roles];
SI-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy addresses purpose;
SI-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy addresses scope;
SI-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy addresses roles;
SI-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy addresses responsibilities;
SI-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy addresses management commitment;
SI-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy addresses coordination among organizational entities;
SI-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy addresses compliance;
SI-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
SI-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures;
SI-01c.01[01] the current system and information integrity policy is reviewed and updated [Assignment: organization-defined frequency];
SI-01c.01[02] the current system and information integrity policy is reviewed and updated following [Assignment: organization-defined events];
SI-01c.02[01] the current system and information integrity procedures are reviewed and updated [Assignment: organization-defined frequency];
SI-01c.02[02] the current system and information integrity procedures are reviewed and updated following [Assignment: organization-defined events].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > Assessment Methods

SI-2 Flaw Remediation - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing flaw remediation

procedures addressing configuration management

list of flaws and vulnerabilities potentially affecting the system

list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws)

test results from the installation of software and firmware updates to correct system flaws

installation/change control records for security-relevant software and firmware updates

system security plan

privacy plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security and privacy responsibilities

organizational personnel responsible for installing, configuring, and/or maintaining the system

organizational personnel responsible for flaw remediation

organizational personnel with configuration management responsibilities

Test: Organizational processes for identifying, reporting, and correcting system flaws

organizational process for installing software and firmware updates

mechanisms supporting and/or implementing the reporting and correcting of system flaws

mechanisms supporting and/or implementing testing software and firmware updates
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > Assessment Objective

SI-2 Flaw Remediation - Assessment Objective
Determine if the following are satisfied:

SI-02a.[01] system flaws are identified;
SI-02a.[02] system flaws are reported;
SI-02a.[03] system flaws are corrected;
SI-02b.[01] software updates related to flaw remediation are tested for effectiveness before installation;
SI-02b.[02] software updates related to flaw remediation are tested for potential side effects before installation;
SI-02b.[03] firmware updates related to flaw remediation are tested for effectiveness before installation;
SI-02b.[04] firmware updates related to flaw remediation are tested for potential side effects before installation;
SI-02c.[01] security-relevant software updates are installed within [Assignment: organization-defined time period] of the release of the updates;
SI-02c.[02] security-relevant firmware updates are installed within [Assignment: organization-defined time period] of the release of the updates;
SI-02d. flaw remediation is incorporated into the organizational configuration management process.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(2) > Assessment Methods

SI-2(2) Automated Flaw Remediation Status - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing flaw remediation

automated mechanisms supporting centralized management of flaw remediation

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for flaw remediation

Test: Automated mechanisms used to determine the state of system components with regard to flaw remediation
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(2) > Assessment Objective

SI-2(2) Automated Flaw Remediation Status - Assessment Objective
Determine if the following are satisfied:

system components have applicable security-relevant software and firmware updates installed [Assignment: organization-defined frequency] using [Assignment: organization-defined automated mechanisms].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(3) > Assessment Methods

SI-2(3) Time to Remediate Flaws and Benchmarks for Corrective Actions - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing flaw remediation

system design documentation

system configuration settings and associated documentation

list of benchmarks for taking corrective action on identified flaws

records that provide timestamps of flaw identification and subsequent flaw remediation activities

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for flaw remediation

Test: Organizational processes for identifying, reporting, and correcting system flaws

mechanisms used to measure the time between flaw identification and flaw remediation
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(3) > Assessment Objective

SI-2(3) Time to Remediate Flaws and Benchmarks for Corrective Actions - Assessment Objective
Determine if the following are satisfied:

SI-02(03)(a) the time between flaw identification and flaw remediation is measured;
SI-02(03)(b) [Assignment: organization-defined benchmarks] for taking corrective actions have been established.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(4) > Assessment Methods

SI-2(4) Automated Patch Management Tools - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing flaw remediation

mechanisms supporting flaw remediation and automatic software/firmware updates

system design documentation

system configuration settings and associated documentation

list of system flaws

records of recent security-relevant software and firmware updates that are automatically installed to system components

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for flaw remediation

Test: Automated patch management tools

mechanisms implementing automatic software/firmware updates

mechanisms facilitating flaw remediation to system components
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(4) > Assessment Objective

SI-2(4) Automated Patch Management Tools - Assessment Objective
Determine if the following are satisfied:

automated patch management tools are employed to facilitate flaw remediation to [Assignment: organization-defined components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(5) > Assessment Methods

SI-2(5) Automatic Software and Firmware Updates - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing flaw remediation

mechanisms supporting flaw remediation and automatic software/firmware updates

system design documentation

system configuration settings and associated documentation

records of recent security-relevant software and firmware updates automatically installed to system components

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for flaw remediation

Test: Mechanisms implementing automatic software/firmware updates
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(5) > Assessment Objective

SI-2(5) Automatic Software and Firmware Updates - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined security-relevant software and firmware updates] are installed automatically to [Assignment: organization-defined system components].
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(6) > Assessment Methods

SI-2(6) Removal of Previous Versions of Software and Firmware - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing flaw remediation

mechanisms supporting flaw remediation

system design documentation

system configuration settings and associated documentation

records of software and firmware component removals after updated versions are installed

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for flaw remediation

Test: Mechanisms supporting and/or implementing the removal of previous versions of software/firmware
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(6) > Assessment Objective

SI-2(6) Removal of Previous Versions of Software and Firmware - Assessment Objective
Determine if the following are satisfied:

previous versions of [Assignment: organization-defined software and firmware components] are removed after updated versions have been installed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(7) > Assessment Methods

SI-2(7) Root Cause Analysis - Assessment Methods and Objects

Examine: System and information integrity policy;

system and information integrity procedures;

procedures addressing flaw remediation;

procedures addressing root cause analysis/process improvement;

system design documentation;

system configuration settings and associated documentation;

system audit records;

system security and privacy plan;

other relevant documents or records

Interview: System/network administrators;

organizational personnel with information security and privacy responsibilities;

organizational personnel responsible for installing, configuring, and/or maintaining the system;

organizational personnel responsible for flaw remediation;

organizational personnel with configuration management responsibilities

Test: Organizational processes for identifying, reporting, and correcting system flaws;

organizational process for installing software and firmware updates;

mechanisms supporting and/or implementing the reporting and correcting of system flaws;

mechanisms supporting and/or implementing testing software and firmware updates
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-2 > SI-2(7) > Assessment Objective

SI-2(7) Root Cause Analysis - Assessment Objective
Determine if the following are satisfied:

Determine if:
SI-02(07)a. Root cause analysis is conducted to identify underlying causes of issues or failures
SI-02(07)b. Actions to address the root cause of the issue of failure are developed
The actions (defined in [SI-02(07)b.](#si-2.7_smt.b)) are implemented
The implementation of actions is monitored for effectiveness.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > Assessment Methods

SI-3 Malicious Code Protection - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

configuration management policy and procedures

procedures addressing malicious code protection

malicious code protection mechanisms

records of malicious code protection updates

system design documentation

system configuration settings and associated documentation

scan results from malicious code protection mechanisms

record of actions initiated by malicious code protection mechanisms in response to malicious code detection

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for malicious code protection

organizational personnel with configuration management responsibilities

Test: Organizational processes for employing, updating, and configuring malicious code protection mechanisms

organizational processes for addressing false positives and resulting potential impacts

mechanisms supporting and/or implementing, employing, updating, and configuring malicious code protection mechanisms

mechanisms supporting and/or implementing malicious code scanning and subsequent actions
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > Assessment Objective

SI-3 Malicious Code Protection - Assessment Objective
Determine if the following are satisfied:

SI-03a.[01] [Selection; one or more: signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code;
SI-03a.[02] [Selection; one or more: signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code;
SI-03b. malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures;
SI-03c.01[01] malicious code protection mechanisms are configured to perform periodic scans of the system [Assignment: organization-defined frequency];
SI-03c.01[02] malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [Selection; one or more: endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy;
SI-03c.02[01] malicious code protection mechanisms are configured to [Selection; one or more: block malicious code; quarantine malicious code; take [Assignment: organization-defined action] ] in response to malicious code detection;
SI-03c.02[02] malicious code protection mechanisms are configured to send alerts to [Assignment: organization-defined personnel or roles] in response to malicious code detection;
SI-03d. the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(4) > Assessment Methods

SI-3(4) Updates Only by Privileged Users - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing malicious code protection

list of privileged users on system

system design documentation

malicious code protection mechanisms

records of malicious code protection updates

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for malicious code protection

Test: Mechanisms supporting and/or implementing malicious code protection capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(4) > Assessment Objective

SI-3(4) Updates Only by Privileged Users - Assessment Objective
Determine if the following are satisfied:

malicious code protection mechanisms are updated only when directed by a privileged user.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(6) > Assessment Methods

SI-3(6) Testing and Verification - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing malicious code protection

system design documentation

system configuration settings and associated documentation

test cases

records providing evidence of test cases executed on malicious code protection mechanisms

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for malicious code protection

Test: Mechanisms supporting and/or implementing the testing and verification of malicious code protection capabilities
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(6) > Assessment Objective

SI-3(6) Testing and Verification - Assessment Objective
Determine if the following are satisfied:

SI-03(06)(a) malicious code protection mechanisms are tested [Assignment: organization-defined frequency] by introducing known benign code into the system;
SI-03(06)(b)[01] the detection of (benign test) code occurs;
SI-03(06)(b)[02] the associated incident reporting occurs.
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(8) > Assessment Methods

SI-3(8) Detect Unauthorized Commands - Assessment Methods and Objects

Examine: System and information integrity policy

system and information integrity procedures

procedures addressing malicious code protection

system design documentation

malicious code protection mechanisms

warning messages sent upon the detection of unauthorized operating system command execution

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

Interview: System/network administrators

organizational personnel with information security responsibilities

system developers

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for malicious code protection

Test: Mechanisms supporting and/or implementing malicious code protection capabilities

mechanisms supporting and/or implementing the detection of unauthorized operating system commands through the kernel application programming interface
Assessing Security and Privacy Controls in Information Systems and Organizations
SI > SI-3 > SI-3(8) > Assessment Objective

SI-3(8) Detect Unauthorized Commands - Assessment Objective
Determine if the following are satisfied:

SI-03(08)(a) [Assignment: organization-defined unauthorized operating system commands] are detected through the kernel application programming interface on [Assignment: organization-defined system hardware components];
SI-03(08)(b) [Selection; one or more: issue a warning; audit the command execution; prevent the execution of the command] is/are performed.