API 1164

Detect (DE): anomalies and events, continuous monitoring, detection processes (Section 8) – API 1164

API 1164 DE.CM-2: DE.CM-2 Physical security events coordinated into IAC monitoring

The plan must require that the monitoring program coordinates with the physical security function for the physical security events used in IAC cyber environment monitoring.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Detect (DE): anomalies and events, continuous monitoring, detection processes (Section 8) – API 1164

DE.AE-1 DE.AE-1 Expected data flows across conduits in the baseline configuration
DE.AE-2 DE.AE-2 Audit anomalies analysed to confirm incidents and understand targets and methods
DE.AE-3 DE.AE-3 Event data from multiple sources correlated and analysed
DE.AE-4 DE.AE-4 Event impact determined with consistent criteria and the API 1164 impact assessment
DE.AE-5 DE.AE-5 Incident alert thresholds defined in the incident response plan
DE.CM-1 DE.CM-1 Continuous monitoring of conduit ingress and egress, extending into zones at higher profiles
DE.CM-3 DE.CM-3 Personnel activity monitoring with privacy and civil liberties considered
DE.CM-4 DE.CM-4 Malware risk assessed per environment and detection deployed and updated per vendor practice

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All API 1164 controls