Assessment Objective

Determine if:

• [Assignment: personnel or roles] are alerted using [Assignment: automated mechanisms] when [Assignment: activities] indicate inappropriate or unusual activities with security implications.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• system security plan
• list of inappropriate or unusual activities with security implications that trigger alerts
• suspicious activity reports
• system monitoring tools and techniques documentation
• system design documentation
• procedures addressing system monitoring tools and techniques
• alerts provided to security personnel
• system configuration settings and associated documentation
• system monitoring logs or records
• system audit records
• other relevant documents or records

Interview

• Personnel with information security responsibilities
• system developers
• personnel installing, configuring, and/or maintaining the system
• personnel responsible for monitoring the system
• personnel responsible for the intrusion detection system
• system/network administrators

Test

• Processes for intrusion detection and system monitoring
• automated mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
• automated mechanisms supporting and/or implementing automated alerts to security personnel

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final