SI-4(19)

Requirement

Implement [Assignment: organization-defined additional monitoring] of individuals who have been identified by [Assignment: organization-defined sources] as posing an increased level of risk.

Discussion

Indications of increased risk from individuals can be obtained from different sources, including personnel records, intelligence agencies, law enforcement organizations, and other sources. The monitoring of individuals is coordinated with the management, legal, security, privacy, and human resource officials who conduct such monitoring. Monitoring is conducted in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring; system design documentation; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system audit records; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for monitoring the system; legal counsel; human resource officials; organizational personnel with personnel security responsibilities].

Test

[SELECT FROM: Organizational processes for system monitoring; mechanisms supporting and/or implementing a system monitoring capability].

ID	Assessment Objectives
SI-04(19)	<SI-04(19)_ODP[01] additional monitoring> is implemented on individuals who have been identified by <SI-04(19)_ODP[02] sources> as posing an increased level of risk.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!