Assessment Objective

Determine if:

• anomalous or suspected adversarial behavior in or related to [Assignment: environments or resources] is analyzed.

Assessment Methods

Examine

• Incident response policy
• procedures addressing system monitoring tools and techniques
• incident response plan
• system monitoring logs or records
• system monitoring tools and techniques documentation
• system configuration settings and associated documentation
• system security plan
• system component inventory
• network diagram
• system protocols documentation
• list of acceptable thresholds for false positives and false negatives
• other relevant documents or records

Interview

• Personnel with information security responsibilities
• system/network administrators

Test

• Processes for detecting anomalous behavior

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final