SI-4(13)

Requirement
1. Analyze communications traffic and event patterns for the system;
2. Develop profiles representing common traffic and event patterns; and
3. Use the traffic and event profiles in tuning system-monitoring devices.

Discussion

Identifying and understanding common communications traffic and event patterns help organizations provide useful information to system monitoring devices to more effectively identify suspicious or anomalous traffic and events when they occur. Such information can help reduce the number of false positives and false negatives during system monitoring.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring tools and techniques; system design documentation; system monitoring tools and techniques documentation; system configuration settings and associated documentation; list of profiles representing common traffic patterns and/or events; system protocols documentation; list of acceptable thresholds for false positives and false negatives; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for monitoring the system; organizational personnel responsible for the intrusion detection system].

Test

[SELECT FROM: Organizational processes for intrusion detection and system monitoring; mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities; mechanisms supporting and/or implementing the analysis of communications traffic and event patterns].

ID	Assessment Objectives
SI-04(13)(b)[02]	profiles representing event patterns are developed;
SI-04(13)(c)[01]	traffic profiles are used in tuning system-monitoring devices;
SI-04(13)(c)[02]	event profiles are used in tuning system-monitoring devices.
SI-04(13)(a)[01]	communications traffic for the system is analyzed;
SI-04(13)(a)[02]	event patterns for the system are analyzed;
SI-04(13)(b)[01]	profiles representing common traffic are developed;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!