SI-4 System monitoring
Requires monitoring of the system to detect attacks and attack indicators against defined monitoring objectives, and to detect connections that were not authorized whether local, networked or remote, with unauthorized us
5
artefacts
3
held by a system
1
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Documented monitoring objectives and the techniques used to identify unauthorized use · SIEM / log platform
- Monitoring architecture showing sensor placement and coverage · SIEM / log platform
- Evidence monitoring components are protected from unauthorized modification · SIEM / log platform
periodic reviewEvidence produced at each review
- Detection records for unauthorized connections and suspicious activity · Document repository
governing documentDocuments that govern the control
- Reports issued to the defined personnel at the defined frequency · Document repository
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Monitoring covers the perimeter while internal and remote connection paths are unwatched
- Monitoring objectives never defined, so alerting is driven by vendor defaults
- Monitoring infrastructure itself unprotected, so an attacker can disable it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSI-3 Malicious code protection · SI-5 Security alerts, advisories, and directives