SI-4(2)

Requirement

Employ automated tools and mechanisms to support near real-time analysis of events.

Discussion

Automated tools and mechanisms include host-based, network-based, transport-based, or storage-based event monitoring tools and mechanisms or security information and event management (SIEM) technologies that provide real-time analysis of alerts and notifications generated by organizational systems. Automated monitoring techniques can create unintended privacy risks because automated controls may connect to external or otherwise unrelated systems. The matching of records between these systems may create linkages with unintended consequences. Organizations assess and document these risks in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.

Title

System Monitoring | Automated Tools and Mechanisms for Real-time Analysis
Family

System and Information Integrity
NIST 800-53B Baseline(s)
- Moderate
- High

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring tools and techniques; system design documentation; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system audit records; system security plan; privacy plan; privacy program plan; privacy impact assessment; privacy risk management documentation; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for monitoring the system; organizational personnel responsible for incident response/management].

Test

[SELECT FROM: Organizational processes for the near real-time analysis of events; organizational processes for system monitoring; mechanisms supporting and/or implementing system monitoring; mechanisms/tools supporting and/or implementing an analysis of events].

ID	Assessment Objectives
SI-04(02)	automated tools and mechanisms are employed to support a near real-time analysis of events.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!