DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
Personnel activity and technology usage are monitored to find potentially adverse events. Control from NIST Cybersecurity Framework 2.0 framework, domain: DE - Detect.
5
artefacts
2
held by a system
0
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Privileged session recording configuration · Identity provider / directory
- Acceptable use monitoring notice and acknowledgement records · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- User and entity behavior analytics deployment scope · Policy repository / GRC workspace
- Insider risk indicator catalog with thresholds · Document repository
- DLP policy library with detection telemetry · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Behavior baselines stale after org changes
- DLP only covers email, not cloud sharing
- Privileged sessions recorded but not reviewed
- Workforce notice not refreshed for new monitoring tools
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDE.CM-02 The physical environment is monitored to find potentially adverse events · DE.CM-06 External service provider activities and services are monitored to find potentially adverse events