+KSI-MLA Monitoring, Logging, and Auditing
---+KSI-MLA-ALA Authorizing Log Access
---+KSI-MLA-EVC Evaluating Configurations
---+KSI-MLA-LET Logging Event Types
---+KSI-MLA-OSM Operating SIEM Capability
---+KSI-MLA-RVL Reviewing Logs
|
KSI-MLA Monitoring, Logging, and Auditing
1. Επισκόπηση
| Τίτλος |
Πρότυπο |
|
KSI-MLA-ALA Authorizing Log Access
|
Class BOptional: A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity. Class CA least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity. NIST SP 800-53 Rev. 5 controls: AU-12(3), AU-6(7), SI-11 Defined terms: Persistently
|
|
KSI-MLA-EVC Evaluating Configurations
|
The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. NIST SP 800-53 Rev. 5 controls: AC-19, CA-7, CM-2, CM-6, CM-6(1), RA-3, SI-7(7) Defined terms: Information Resource, Machine-Based (Information Resources), Persistently
|
|
KSI-MLA-LET Logging Event Types
|
A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. NIST SP 800-53 Rev. 5 controls: AC-17(1), AC-2(4), AC-20(1), AC-6(9), AU-10, AU-12, AU-2, AU-7, AU-7(1), CM-5(1), IR-9(4), SI-4(19), SI-4(20), SI-4(4), SI-4(5), SI-7(7) Defined terms: Information Resource, Persistently
|
|
KSI-MLA-OSM Operating SIEM Capability
|
A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. NIST SP 800-53 Rev. 5 controls: AC-17(1), AC-20(1), AU-11, AU-12(1), AU-2, AU-3, AU-3(1), AU-4, AU-5, AU-5(1), AU-6(1), AU-6(3), AU-6(4), AU-6(5), AU-7, AU-7(1), AU-8, AU-9, IR-4(1), SI-4(16), SI-4(2), SI-4(4) Defined terms: Persistently
|
|
KSI-MLA-RVL Reviewing Logs
|
Logs are persistently reviewed and audited. NIST SP 800-53 Rev. 5 controls: AC-2(4), AC-6(9), AU-2, AU-6, AU-6(1), AU-7, RA-5(8), SI-4, SI-4(19), SI-4(4) Defined terms: Persistently
|
1.1 Παραπομπές
1.2 Εντοπισμένες απαιτήσεις
1.3 Σχετικοί κανονισμοί
2. Εντοπισμένες απαιτήσεις
3. Σχετικοί κανονισμοί
Κανονισμοί
| Πηγή |
Κανονισμός |
- FedRAMP Consolidated Rules -
EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.
DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.
|