+SI-04(07) Automated Response to Suspicious Events

SI-04(07) Automated Response to Suspicious Events

Control

  1. Notify [Assignement: incident response personnel] of detected suspicious events; and
  2. Take the following actions upon detection: [Assignement: least-disruptive actions].

Discussion

Least-disruptive actions include initiating requests for human responses.

Assessment Objective

  1. [Assignement: incident response personnel] are notified of detected suspicious events;
  2. [Assignement: least-disruptive actions] are taken upon the detection of suspicious events.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation alerts and notifications generated based on detected suspicious events records of actions taken to terminate suspicious events system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developers organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system organizational personnel responsible for the intrusion detection system

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav

3. Relaterade regleringar

Regleringar

Länkade ärenden

Länkar
is blocked by SI-04(07) Automated Response to Suspicious Events – Assessment Procedure
is blocked by Automated Response to Suspicious Events
is blocked by Automated Incident Handling Processes