SM-17—Security Monitoring Alert Criteria: VoIP Usage

>Control Description

Organization defines security monitoring alert criteria to detect deviations from Voice over IP (VoIP) activity standards.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that Organization's Security Monitoring Standard includes requirements for security monitoring alert criteria to detect deviations from Voice over IP (VoIP) activity standards are defined. 2. Ensure that the security monitoring rules are defined, enabled and alert applicable personnel on deviations from Voice over IP (VoIP) activity standards. 3. Ensure that alerts are being generated and sent to the SOC team to support remediation.

>Testing Procedure

1. Inspect Organization's Security Monitoring Standard to determine requirements for security monitoring alert criteria to detect deviations from Voice over IP (VoIP) activity standards are defined. 2. Inspect a sample of security monitoring rules, to validate that the rules are defined to look for and alert applicable personnel on deviations from Voice over IP (VoIP) activity standards. 3. Validate that alerts being generated are sent to the SOC team to support remediation.