KSI-MLA-OSM Operating SIEM Capability

A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.

NIST SP 800-53 Rev. 5 controls: AC-17(1), AC-20(1), AU-11, AU-12(1), AU-2, AU-3, AU-3(1), AU-4, AU-5, AU-5(1), AU-6(1), AU-6(3), AU-6(4), AU-6(5), AU-7, AU-7(1), AU-8, AU-9, IR-4(1), SI-4(16), SI-4(2), SI-4(4)

Defined terms: Persistently

1. Übersicht

1.1 Referenzen

• AC-17(01) Monitoring and Control
• AC-20(01) Limits on Authorized Use
• AU-11 Audit Record Retention
• AU-12(01) System-wide and Time-correlated Audit Trail
• AU-02 Event Logging
• AU-03 Content of Audit Records
• AU-03(01) Additional Audit Information
• AU-04 Audit Log Storage Capacity
• AU-05 Response to Audit Logging Process Failures
• AU-05(01) Storage Capacity Warning
• AU-06(01) Automated Process Integration
• AU-06(03) Correlate Audit Record Repositories
• AU-06(04) Central Review and Analysis
• AU-06(05) Integrated Analysis of Audit Records
• AU-07 Audit Record Reduction and Report Generation
• AU-07(01) Automatic Processing
• AU-08 Time Stamps
• AU-09 Protection of Audit Information
• IR-04(01) Automated Incident Handling Processes
• SI-04(16) Correlate Monitoring Information
• SI-04(02) Automated Tools and Mechanisms for Real-time Analysis
• SI-04(04) Inbound and Outbound Communications Traffic
• FRD-PER Persistently

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.