SI-4—System Monitoring
>Control Description
Monitor the system to detect:
Attacks and indicators of potential attacks in accordance with the following monitoring objectives:
Intrusion detection and prevention
Malicious code protection
Vulnerability scanning
Audit record monitoring
Network monitoring
Firewall monitoring; and
Unauthorized local, network, and remote connections;
Identify unauthorized use of the system through the following techniques and methods: event logging (ref. 5.4 Audit and Accountability);
Invoke internal monitoring capabilities or deploy monitoring devices:
Strategically within the system to collect organization-determined essential information; and
At ad hoc locations within the system to track specific types of transactions of interest to the organization;
Analyze detected events and anomalies;
Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
Obtain legal opinion regarding system monitoring activities; and
Provide intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring, and firewall monitoring software logs to organizational personnel with information security responsibilities weekly.
>Cross-Framework Mappings
Ask AI
Configure your API key to use AI features.