03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring

Statement

Track incidents and collect and analyze incident information using {{ insert: param, A.03.06.04E_prm_1 }}.

Guidance

Automated mechanisms for tracking incidents and collecting and analyzing incident information include electronic databases of incidents and network monitoring devices. This requirement enhances SP 800-171 requirement 03.06.02.

Statement

• (includes detect and reveal) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

incidents are tracked using {{ insert: param, A.03.06.04E.ODP.01 }}.

Assessment objective

incident information is collected using {{ insert: param, A.03.06.04E.ODP.02 }}.

Assessment objective

incident information is analyzed using {{ insert: param, A.03.06.04E.ODP.03 }}.

Assessment method

• Incident response policy procedures addressing incident monitoring incident response records and documentation system security plan incident response plan other relevant documents or records

Assessment method

• Personnel with incident monitoring responsibilities personnel with information security responsibilities

Assessment method

• Incident monitoring capability for the organization automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final