SC-48 Sensor Relocation. Relocate [organization-defined] to [organization-defined] under the following conditions or circumstances: [organization-defined]
Sensor Relocation. Relocate [organization-defined] to [organization-defined] under the following conditions or circumstances: [organization-defined].
5
artefacts
3
held by a system
0
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The defined sensors or monitoring capabilities eligible for relocation and the defined locations they may move to · SIEM / log platform
- Change control and configuration management records for each relocation performed · Cloud console / configuration management
- Evidence monitoring coverage was maintained during and after the move · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The defined conditions or circumstances that trigger relocation · Document repository
- Rationale showing relocation responds to adversary awareness rather than convenience · HR system / LMS
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Sensors moved without change records, so the monitoring baseline no longer matches the deployment
- Relocation leaves a coverage gap at the vacated location that nobody assesses
- Trigger conditions undefined, so relocation is ad hoc and predictable
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-47 Alternate Communications Paths. Establish [organization-defined] for system operations organizational command and control · SC-49 Hardware-enforced Separation and Policy Enforcement. Implement hardware-enforced separation and policy enforcement mechanisms between [organization-defined]