+SI-07(07) [H] Integration of Detection and Response

SI-07(07) [H] Integration of Detection and Response

Control

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignement: changes].

Discussion

Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of system privileges.

Assessment Objective

the detection of [Assignement: changes] are incorporated into the organizational incident response capability.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity procedures addressing incident response system design documentation system configuration settings and associated documentation incident response records audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities organizational personnel with incident response responsibilities

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by SI-07(07) [H] Integration of Detection and Response – Assessment Procedure
is blocked by Endpoint Detection & Response (EDR)