<commit_before>documentation_complete: false
name: Risk Assessment
schema_version: 3.0.0
satisfies:

- control_key: RA-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing, documenting, and
        disseminating Risk Assessment policy and procedures. A successful
        control response will need to address the content of the policy
        (which must include purpose, scope, roles, responsibilities, 
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implimentation of the policies and associated
        controls).>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        Risk Assessment policy every 3 years, and procedures annually. A
        successful control repsonse will need to address the reiew and update
        process, including the role(s) repsonsible for initiating the review
        process, updating the policy and procedures, and providing approval
        of the updates.>'

- control_key: RA-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for categorizing the customer
        system and information contained within it. A successful control
        response will need to address the applicable Federal Laws, Executive
        Orders, directives, policies, regulations, standards, and guidance, as
        well as the key stakeholders involved in the categorization decision.

        Resources related to information categorization include FIPS 199,
        Standards for Security Categorization of Federal Information and
        Information Systems, and NIST SP 800-61, Rev. 1, Guide for Mapping
        Types of Information and Inforation Systems to Security Categories.>'
    - key: b
      text: |
        '<The customer will be responsible for documenting the security
        categorization. A successful response will need to address supporting
        rationale, including types of information considered, risk impact
        analysis, and input from stakeholders and organizational officials.>'
    - key: c
      text: |
        '<The customer will be responsible for presneting the security
        categorization decision to the Authorizing Official or a
        designated representative for review and approval.>'

- control_key: RA-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for conducting a risk assessment,
        including a review of controls inherited from infrastruture providers,
        and for those which the customer is responsible. A successful control
        response will need to address the assessment methodology and calculation
        of the likelihood and magnitude of harm that could result from 
        unauthorized access, use, disclosure, disruption, or modification of
        IaaS layers, the customer application, and the information processed,
        stored, and transmitted by those systems.

        NIST SP 80-30 Rev. 1, Guide for Conducting Risk Assessments, and NIST
        SP 800-53A Rev. 4, Assessing Security and Privacy Controls in Federal
        Information Systems and Organizations: Building Effective Assessment
        Plans both provide guidance that may be used by the customer in
        developing the risk assessment methodology and performing the risk
        assessment.>'
    - key: b
      text: |
        '<The customer will be responsible for documenting the results of the
        risk assessment in a Security Assessment Report. A successful control
        response will need to address specific requirements for the report
        (e.g., it should include controls that are considered "other than 
        satisfied," potential weaknesses in control sthat meet minimum
        requirements, recommended remediation steps, and risks associated with
        the system). The customer may with to employ a 3PAO to assist with
        the initial risk assessment (see CA-2).>'
    - key: c
      text: |
        '<The customer will be responsible for reviewing risk assessment results
        at the required frequency. A successful control response will need to 
        address the personnel or roles responsible for reviewing results, as
        well as any actions taken in response to risk assessment results.>'
    - key: d
      text: |
        '<The customer will be responsible for disseminating risk assessment
        results to customer-defined stakeholders and organizational officials. A
        successful control response will need to outline the stakeholders
        involved and the means of distribution of results.>'
    - key: e
      text: |
        '<The customer will be responsible for updating the risk assessment
        at the required frequency of when a significant change occurs. (Note
        that "significant change" is defined in NIST 800-37 Rev 1, Appendix F).
        A successful control respinse will need to discuss examples of
        significant changes that might occur within the customer application,
        as well as the specific actions that will be taken when the risk
        assessment is updated (such as updating system security plans and
        other documentation).>'

- control_key: RA-5
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for scanning for vulnerabilities
        in customer applications and databases. Additionally, IaaS customers
        using an operating system image will be responsible for scanning
        for vulnerabilities in the operating system. A successful control
        response will need to address the tools used to perform scans as well
        as the additional FedRAMP requirement for independant assessors to
        scan the system on an annual basis.>'
    - key: b
      text: |
        '<The customer will be responsible for ensuring that vulnerability
        scanning tools use standards for enumerating components, flaws, and
        improper configurations; formatting checklists and test procedures;
        and measuring vulnerability impact. A successful control response will
        need to address how each vulnerability scanning tool in use meets these
        requirements (for example, by using Common Vulnerabilities and
        Exposures (CVE) values).>'
    - key: c
      text: |
        '<The customer will be responsible for analyzing scan reports and
        assessment results for actionable data. A successful control response
        will need to address the roles or personnel responsible for the
        analysis, as well as criteria used in performing the analysis.>'
    - key: d
      text: |
        '<The customer will be responsible for remediating vulnerabilities in
        customer applications and customer-provider OS images in accordance
        with the required timeframes. A successful control response will need
        to address prioritization of remediation activities and roles or
        personnel responsible for ensuring that timeframe requirements are
        met.>'
    - key: e
      text: |
        '<The customer will be responsible for sharing vulnerability scan
        results and security assessment reports with customer-defined
        stakeholders. A successful control response will need to address the
        stakeholders involved and the types of information shared with
        each stakeholder.>'

- control_key: RA-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for scanning customer applications
        and customer-deployed operating system images using compliant
        vulnerability scanning tools. A successful control response will need
        to address the specific tools used and the process required to
        update the list of information system vulnerabilities to be scanned
        for each.>'

- control_key: RA-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for updating the list of
        vulnerabilities scanner prior to each scan. A successful control
        response will need to address the roles or personnel responsible for
        ensuring that this requirement is met, as well as the process for
        initiating a new scan if the required update does not occur.>'

- control_key: RA-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against RA-5 (3) goes here.

        This answer can be multi-line.

- control_key: RA-5 (5)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against RA-5 (5) goes here.

        This answer can be multi-line.

- control_key: RA-5 (6)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against RA-5 (6) goes here.

        This answer can be multi-line.

- control_key: RA-5 (8)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against RA-5 (8) goes here.

        This answer can be multi-line.
<commit_msg>through RA-5(3)<commit_after>documentation_complete: false
name: Risk Assessment
schema_version: 3.0.0
satisfies:

- control_key: RA-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing, documenting, and
        disseminating Risk Assessment policy and procedures. A successful
        control response will need to address the content of the policy
        (which must include purpose, scope, roles, responsibilities, 
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implimentation of the policies and associated
        controls).>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        Risk Assessment policy every 3 years, and procedures annually. A
        successful control repsonse will need to address the reiew and update
        process, including the role(s) repsonsible for initiating the review
        process, updating the policy and procedures, and providing approval
        of the updates.>'

- control_key: RA-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for categorizing the customer
        system and information contained within it. A successful control
        response will need to address the applicable Federal Laws, Executive
        Orders, directives, policies, regulations, standards, and guidance, as
        well as the key stakeholders involved in the categorization decision.

        Resources related to information categorization include FIPS 199,
        Standards for Security Categorization of Federal Information and
        Information Systems, and NIST SP 800-61, Rev. 1, Guide for Mapping
        Types of Information and Inforation Systems to Security Categories.>'
    - key: b
      text: |
        '<The customer will be responsible for documenting the security
        categorization. A successful response will need to address supporting
        rationale, including types of information considered, risk impact
        analysis, and input from stakeholders and organizational officials.>'
    - key: c
      text: |
        '<The customer will be responsible for presneting the security
        categorization decision to the Authorizing Official or a
        designated representative for review and approval.>'

- control_key: RA-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for conducting a risk assessment,
        including a review of controls inherited from infrastruture providers,
        and for those which the customer is responsible. A successful control
        response will need to address the assessment methodology and calculation
        of the likelihood and magnitude of harm that could result from 
        unauthorized access, use, disclosure, disruption, or modification of
        IaaS layers, the customer application, and the information processed,
        stored, and transmitted by those systems.

        NIST SP 80-30 Rev. 1, Guide for Conducting Risk Assessments, and NIST
        SP 800-53A Rev. 4, Assessing Security and Privacy Controls in Federal
        Information Systems and Organizations: Building Effective Assessment
        Plans both provide guidance that may be used by the customer in
        developing the risk assessment methodology and performing the risk
        assessment.>'
    - key: b
      text: |
        '<The customer will be responsible for documenting the results of the
        risk assessment in a Security Assessment Report. A successful control
        response will need to address specific requirements for the report
        (e.g., it should include controls that are considered "other than 
        satisfied," potential weaknesses in control sthat meet minimum
        requirements, recommended remediation steps, and risks associated with
        the system). The customer may with to employ a 3PAO to assist with
        the initial risk assessment (see CA-2).>'
    - key: c
      text: |
        '<The customer will be responsible for reviewing risk assessment results
        at the required frequency. A successful control response will need to 
        address the personnel or roles responsible for reviewing results, as
        well as any actions taken in response to risk assessment results.>'
    - key: d
      text: |
        '<The customer will be responsible for disseminating risk assessment
        results to customer-defined stakeholders and organizational officials. A
        successful control response will need to outline the stakeholders
        involved and the means of distribution of results.>'
    - key: e
      text: |
        '<The customer will be responsible for updating the risk assessment
        at the required frequency of when a significant change occurs. (Note
        that "significant change" is defined in NIST 800-37 Rev 1, Appendix F).
        A successful control respinse will need to discuss examples of
        significant changes that might occur within the customer application,
        as well as the specific actions that will be taken when the risk
        assessment is updated (such as updating system security plans and
        other documentation).>'

- control_key: RA-5
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for scanning for vulnerabilities
        in customer applications and databases. Additionally, IaaS customers
        using an operating system image will be responsible for scanning
        for vulnerabilities in the operating system. A successful control
        response will need to address the tools used to perform scans as well
        as the additional FedRAMP requirement for independant assessors to
        scan the system on an annual basis.>'
    - key: b
      text: |
        '<The customer will be responsible for ensuring that vulnerability
        scanning tools use standards for enumerating components, flaws, and
        improper configurations; formatting checklists and test procedures;
        and measuring vulnerability impact. A successful control response will
        need to address how each vulnerability scanning tool in use meets these
        requirements (for example, by using Common Vulnerabilities and
        Exposures (CVE) values).>'
    - key: c
      text: |
        '<The customer will be responsible for analyzing scan reports and
        assessment results for actionable data. A successful control response
        will need to address the roles or personnel responsible for the
        analysis, as well as criteria used in performing the analysis.>'
    - key: d
      text: |
        '<The customer will be responsible for remediating vulnerabilities in
        customer applications and customer-provider OS images in accordance
        with the required timeframes. A successful control response will need
        to address prioritization of remediation activities and roles or
        personnel responsible for ensuring that timeframe requirements are
        met.>'
    - key: e
      text: |
        '<The customer will be responsible for sharing vulnerability scan
        results and security assessment reports with customer-defined
        stakeholders. A successful control response will need to address the
        stakeholders involved and the types of information shared with
        each stakeholder.>'

- control_key: RA-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for scanning customer applications
        and customer-deployed operating system images using compliant
        vulnerability scanning tools. A successful control response will need
        to address the specific tools used and the process required to
        update the list of information system vulnerabilities to be scanned
        for each.>'

- control_key: RA-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for updating the list of
        vulnerabilities scanner prior to each scan. A successful control
        response will need to address the roles or personnel responsible for
        ensuring that this requirement is met, as well as the process for
        initiating a new scan if the required update does not occur.>'

- control_key: RA-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for ensuring that vulnerability
        scanning tools and procedures demonstrate the breadth and depth of
        coverage. A successful control response will need to address the
        specific tools in use and discuss the reason each tool is felt to
        provide sufficient breadth and depth of coverage.>'

- control_key: RA-5 (5)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against RA-5 (5) goes here.

        This answer can be multi-line.

- control_key: RA-5 (6)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against RA-5 (6) goes here.

        This answer can be multi-line.

- control_key: RA-5 (8)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against RA-5 (8) goes here.

        This answer can be multi-line.

{'fraction_non_alphanumeric': 0.04366966906183584, 'fraction_numerical': 0.010727659143811356, 'mean_word_length': 2.8419517884914463, 'pattern_counts': {'":': 0, '<': 38, '<?xml version=': 0, '>': 38, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4935875', 'n_tokens_mistral': 4739, 'n_tokens_neox': 4565, 'n_words': 2354}