SI-4 System Monitoring

a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: organization-defined monitoring objectives; and 2. Unauthorized local, network, and remote connections; b. Identify unauthorized use of the system through the following techniques and methods: organization-defined techniques and methods; c. Invoke internal monitoring capabilities or deploy monitoring devices: 1. Strategically within the system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Analyze detected events and anomalies; e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f. Obtain legal opinion regarding system monitoring activities; and g. Provide organization-defined system monitoring information to organization-defined personnel or roles Selection (one or more): as needed; [organization-defined frequency].

Source: NIST SP 800-53 Rev 5, SI-4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.

Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.