SI-04 [M] System Monitoring

Control

1. Monitor the system to detect:
   1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignement: monitoring objectives] ; and
   2. Unauthorized local, network, and remote connections;
2. Identify unauthorized use of the system through the following techniques and methods: [Assignement: techniques and methods];
3. Invoke internal monitoring capabilities or deploy monitoring devices:
   1. Strategically within the system to collect organization-determined essential information; and
   2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
4. Analyze detected events and anomalies;
5. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
6. Obtain legal opinion regarding system monitoring activities; and
7. Provide [Assignement: system monitoring information] to [Assignement: personnel or roles] [Selection(one-or-more): as needed; {{ insert: param, si-04_odp.06 }} ].

Discussion

Assessment Objective

1. 1. the system is monitored to detect attacks and indicators of potential attacks in accordance with [Assignement: monitoring objectives];
   2. 1. the system is monitored to detect unauthorized local connections;
      2. the system is monitored to detect unauthorized network connections;
      3. the system is monitored to detect unauthorized remote connections;
2. unauthorized use of the system is identified through [Assignement: techniques and methods];
3. 1. internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information;
   2. internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization;
4. 1. detected events are analyzed;
   2. detected anomalies are analyzed;
5. the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
6. a legal opinion regarding system monitoring activities is obtained;
7. [Assignement: system monitoring information] is provided to [Assignement: personnel or roles] [Selection(one-or-more): as needed; {{ insert: param, si-04_odp.06 }} ].

Assessment Method

Examine

Interview

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

Συνδεδεμένα ζητήματα

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final