ezesecops/rmf-ato-core huggingface dataset:
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-23 > Assessment Objective

PM-23 Data Governance Body - Assessment Objective
Determine if the following are satisfied:

a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities] is established.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-24 > Assessment Methods

PM-24 Data Integrity Board - Assessment Methods and Objects

Examine: Privacy program plan

privacy program documents relating to the Data Integrity Board, including documents establishing the board, its charter of operations, and any plans and reports

computer matching agreements and notices

information sharing agreements

memoranda of understanding

records documenting annual reviews

governing requirements, including laws, executive orders, regulations, standards, and guidance

Interview: members of the Data Integrity Board (e.g., the chief information officer, senior information security officer, senior agency official for privacy, and agency Inspector General)
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-24 > Assessment Objective

PM-24 Data Integrity Board - Assessment Objective
Determine if the following are satisfied:

a Data Integrity Board is established;
PM-24a. the Data Integrity Board reviews proposals to conduct or participate in a matching program;
PM-24b. the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-25 > Assessment Methods

PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research - Assessment Methods and Objects

Examine: Privacy program plan

policies and procedures for the minimization of personally identifiable information used in testing, training, and research

documentation supporting policy implementation (e.g., templates for testing, training, and research

privacy threshold analysis

privacy risk assessment)

data sets used for testing, training, and research

Interview: Organizational personnel with privacy program responsibilities

organizational personnel with privacy responsibilities

system developers

personnel with IRB responsibilities

Test: Organizational processes for data quality and personally identifiable information management

mechanisms supporting data quality management and personally identifiable information management to minimize the use of personally identifiable information
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-25 > Assessment Objective

PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research - Assessment Objective
Determine if the following are satisfied:

PM-25a.[01] policies that address the use of personally identifiable information for internal testing are developed and documented;
PM-25a.[02] policies that address the use of personally identifiable information for internal training are developed and documented;
PM-25a.[03] policies that address the use of personally identifiable information for internal research are developed and documented;
PM-25a.[04] procedures that address the use of personally identifiable information for internal testing are developed and documented;
PM-25a.[05] procedures that address the use of personally identifiable information for internal training are developed and documented;
PM-25a.[06] procedures that address the use of personally identifiable information for internal research are developed and documented;
PM-25a.[07] policies that address the use of personally identifiable information for internal testing, are implemented;
PM-25a.[08] policies that address the use of personally identifiable information for training are implemented;
PM-25a.[09] policies that address the use of personally identifiable information for research are implemented;
PM-25a.[10] procedures that address the use of personally identifiable information for internal testing are implemented;
PM-25a.[11] procedures that address the use of personally identifiable information for training are implemented;
PM-25a.[12] procedures that address the use of personally identifiable information for research are implemented;
PM-25b.[01] the amount of personally identifiable information used for internal testing purposes is limited or minimized;
PM-25b.[02] the amount of personally identifiable information used for internal training purposes is limited or minimized;
PM-25b.[03] the amount of personally identifiable information used for internal research purposes is limited or minimized;
PM-25c.[01] the required use of personally identifiable information for internal testing is authorized;
PM-25c.[02] the required use of personally identifiable information for internal training is authorized;
PM-25c.[03] the required use of personally identifiable information for internal research is authorized;
PM-25d.[01] policies are reviewed [Assignment: organization-defined frequency];
PM-25d.[02] policies are updated [Assignment: organization-defined frequency];
PM-25d.[03] procedures are reviewed [Assignment: organization-defined frequency];
PM-25d.[04] procedures are updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-26 > Assessment Methods

PM-26 Complaint Management - Assessment Methods and Objects

Examine: Privacy program plan

procedures addressing complaint management

complaint documentation

procedures addressing the reviews of complaints

other relevant documents or records

Interview: Organizational personnel with privacy program responsibilities

organizational personnel with privacy responsibilities

Test: Organizational processes for complaint management

mechanisms supporting complaint management

tools used by the public to submit complaints, concerns, and questions (e.g., telephone, hotline, email, or web-based forms
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-26 > Assessment Objective

PM-26 Complaint Management - Assessment Objective
Determine if the following are satisfied:

PM-26[01] a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
PM-26[02] a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
PM-26a.[01] the complaint management process includes mechanisms that are easy to use by the public;
PM-26a.[02] the complaint management process includes mechanisms that are readily accessible by the public;
PM-26b. the complaint management process includes all information necessary for successfully filing complaints;
PM-26c.[01] the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [Assignment: organization-defined time period];
PM-26c.[02] the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [Assignment: organization-defined time period];
PM-26d. the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [Assignment: organization-defined time period];
PM-26e. the complaint management process includes responding to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-27 > Assessment Methods

PM-27 Privacy Reporting - Assessment Methods and Objects

Examine: Privacy program plan

internal and external privacy reports

privacy program plan

annual senior agency official for privacy reports to OMB

reports to Congress required by law, regulation, or policy, including internal policies

records documenting the dissemination of reports to oversight bodies and officials responsible for monitoring privacy program compliance

records of review and updates of privacy reports.

Interview: Organizational personnel with privacy program responsibilities

organizational personnel with privacy responsibilities

legal counsel.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-27 > Assessment Objective

PM-27 Privacy Reporting - Assessment Objective
Determine if the following are satisfied:

PM-27a. [Assignment: organization-defined privacy reports] are developed;
PM-27a.01 the privacy reports are disseminated to [Assignment: organization-defined oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates;
PM-27a.02[01] the privacy reports are disseminated to [Assignment: organization-defined officials];
PM-27a.02[02] the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;
PM-27b. the privacy reports are reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-28 > Assessment Methods

PM-28 Risk Framing - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

supply chain risk management strategy

documentation of risk framing activities

policies and procedures for risk framing activities

risk management strategy

Interview: Organizational personnel (including mission, business, and system owners or stewards

authorizing officials

senior agency information security officer

senior agency official for privacy

and senior accountable official for risk management)

Test: Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing

organizational processes for risk framing

mechanisms supporting the development, review, update, and approval of risk framing
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-28 > Assessment Objective

PM-28 Risk Framing - Assessment Objective
Determine if the following are satisfied:

PM-28a.01[01] assumptions affecting risk assessments are identified and documented;
PM-28a.01[02] assumptions affecting risk responses are identified and documented;
PM-28a.01[03] assumptions affecting risk monitoring are identified and documented;
PM-28a.02[01] constraints affecting risk assessments are identified and documented;
PM-28a.02[02] constraints affecting risk responses are identified and documented;
PM-28a.02[03] constraints affecting risk monitoring are identified and documented;
PM-28a.03[01] priorities considered by the organization for managing risk are identified and documented;
PM-28a.03[02] trade-offs considered by the organization for managing risk are identified and documented;
PM-28a.04 organizational risk tolerance is identified and documented;
PM-28b. the results of risk framing activities are distributed to [Assignment: organization-defined personnel];
PM-28c. risk framing considerations are reviewed and updated [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-29 > Assessment Methods

PM-29 Risk Management Program Leadership Roles - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

risk management strategy

supply chain risk management strategy

documentation of appointment, roles, and responsibilities of a Senior Accountable Official for Risk Management

documentation of actions taken by the Official

documentation of the establishment, policies, and procedures of a Risk Executive (function)

Interview: Senior Accountable Official for Risk Management

chief information officer

senior agency information security officer

senior agency official for privacy

organizational personnel with information security and privacy program responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-29 > Assessment Objective

PM-29 Risk Management Program Leadership Roles - Assessment Objective
Determine if the following are satisfied:

PM-29a.[01] a Senior Accountable Official for Risk Management is appointed;
PM-29a.[02] a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes;
PM-29b.[01] a Risk Executive (function) is established;
PM-29b.[02] a Risk Executive (function) views and analyzes risk from an organization-wide perspective;
PM-29b.[03] a Risk Executive (function) ensures that the management of risk is consistent across the organization.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-30 > Assessment Methods

PM-30 Supply Chain Risk Management Strategy - Assessment Methods and Objects

Examine: Supply chain risk management strategy

organizational risk management strategy

enterprise risk management documents

other relevant documents or records

Interview: Organizational personnel with supply chain risk management responsibilities

organizational personnel with information security responsibilities

organizational personnel with acquisition responsibilities

organizational personnel with enterprise risk management responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-30 > Assessment Objective

PM-30 Supply Chain Risk Management Strategy - Assessment Objective
Determine if the following are satisfied:

PM-30a.[01] an organization-wide strategy for managing supply chain risks is developed;
PM-30a.[02] the supply chain risk management strategy addresses risks associated with the development of systems;
PM-30a.[03] the supply chain risk management strategy addresses risks associated with the development of system components;
PM-30a.[04] the supply chain risk management strategy addresses risks associated with the development of system services;
PM-30a.[05] the supply chain risk management strategy addresses risks associated with the acquisition of systems;
PM-30a.[06] the supply chain risk management strategy addresses risks associated with the acquisition of system components;
PM-30a.[07] the supply chain risk management strategy addresses risks associated with the acquisition of system services;
PM-30a.[08] the supply chain risk management strategy addresses risks associated with the maintenance of systems;
PM-30a.[09] the supply chain risk management strategy addresses risks associated with the maintenance of system components;
PM-30a.[10] the supply chain risk management strategy addresses risks associated with the maintenance of system services;
PM-30a.[11] the supply chain risk management strategy addresses risks associated with the disposal of systems;
PM-30a.[12] the supply chain risk management strategy addresses risks associated with the disposal of system components;
PM-30a.[13] the supply chain risk management strategy addresses risks associated with the disposal of system services;
PM-30b. the supply chain risk management strategy is implemented consistently across the organization;
PM-30c. the supply chain risk management strategy is reviewed and updated [Assignment: organization-defined frequency] or as required to address organizational changes.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-30 > PM-30(1) > Assessment Methods

PM-30(1) Suppliers of Critical or Mission-essential Items - Assessment Methods and Objects

Examine: Supply chain risk management strategy

organization-wide risk management strategy

enterprise risk management documents

inventory records or suppliers

assessment and prioritization documentation

critical or mission-essential technologies, products, and service documents or records

other relevant documents or records

Interview: Organizational personnel with supply chain risk management responsibilities

organizational personnel with information security responsibilities

organizational personnel with acquisition responsibilities

organizational personnel with enterprise risk management responsibilities

Test: Organizational processes for identifying, prioritizing, and assessing critical or mission-essential technologies, products, and services

organizational processes for maintaining an inventory of suppliers

organizational process for associating suppliers with critical or mission-essential technologies, products, and services
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-30 > PM-30(1) > Assessment Objective

PM-30(1) Suppliers of Critical or Mission-essential Items - Assessment Objective
Determine if the following are satisfied:

PM-30(01)[01] suppliers of critical or mission-essential technologies, products, and services are identified;
PM-30(01)[02] suppliers of critical or mission-essential technologies, products, and services are prioritized;
PM-30(01)[03] suppliers of critical or mission-essential technologies, products, and services are assessed.
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-31 > Assessment Methods

PM-31 Continuous Monitoring Strategy - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

supply chain risk management plan

continuous monitoring strategy

risk management strategy

information security continuous monitoring program documentation, reporting, metrics, and artifacts

information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts

assessment and authorization policy

procedures addressing the continuous monitoring of controls

privacy program continuous monitoring documentation, reporting, metrics, and artifacts

continuous monitoring program records, security, and privacy impact analyses

status reports

risk response documentation

other relevant documents or records.

Interview: Senior Accountable Official for Risk Management

chief information officer

senior agency information security officer

senior agency official for privacy

organizational personnel with information security, privacy, and supply chain risk management program responsibilities

Test: Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-31 > Assessment Objective

PM-31 Continuous Monitoring Strategy - Assessment Objective
Determine if the following are satisfied:

an organization-wide continuous monitoring strategy is developed;
PM-31a. continuous monitoring programs are implemented that include establishing [Assignment: organization-defined metrics] to be monitored;
PM-31b.[01] continuous monitoring programs are implemented that establish [Assignment: organization-defined monitoring frequencies] for monitoring;
PM-31b.[02] continuous monitoring programs are implemented that establish [Assignment: organization-defined assessment frequencies] for assessment of control effectiveness;
PM-31c. continuous monitoring programs are implemented that include monitoring [Assignment: organization-defined metrics] on an ongoing basis in accordance with the continuous monitoring strategy;
PM-31d.[01] continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;
PM-31d.[02] continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;
PM-31e.[01] continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;
PM-31e.[02] continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;
PM-31f.[01] continuous monitoring programs are implemented that include reporting the security status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency];
PM-31f.[02] continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-32 > Assessment Methods

PM-32 Purposing - Assessment Methods and Objects

Examine: Information security program plan

privacy program plan

list of essential services and functions

organizational analysis of information resources

risk management strategy

other relevant documents or records.

Interview: Organizational personnel with information security, privacy, and supply chain risk management program responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
PM > PM-32 > Assessment Objective

PM-32 Purposing - Assessment Objective
Determine if the following are satisfied:

[Assignment: organization-defined systems or system components] supporting mission-essential services or functions are analyzed to ensure that the information resources are being used in a manner that is consistent with their intended purpose.
Assessing Security and Privacy Controls in Information Systems and Organizations
PS > PS-1 > Assessment Methods

PS-1 Policy and Procedures - Assessment Methods and Objects

Examine: Personnel security policy

personnel security procedures

system security plan

privacy plan

risk management strategy documentation

audit findings

other relevant documents or records

Interview: Organizational personnel with personnel security responsibilities

organizational personnel with information security responsibilities