API 1164

Detect (DE): anomalies and events, continuous monitoring, detection processes (Section 8) – API 1164

API 1164 DE.CM-3: DE.CM-3 Personnel activity monitoring with privacy and civil liberties considered

The plan must require that the monitoring program includes personnel activity in interacting with IAC cyber assets and considers privacy and civil liberties through collaboration with legal, compliance and human resources.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Detect (DE): anomalies and events, continuous monitoring, detection processes (Section 8) – API 1164

DE.AE-1 DE.AE-1 Expected data flows across conduits in the baseline configuration
DE.AE-2 DE.AE-2 Audit anomalies analysed to confirm incidents and understand targets and methods
DE.AE-3 DE.AE-3 Event data from multiple sources correlated and analysed
DE.AE-4 DE.AE-4 Event impact determined with consistent criteria and the API 1164 impact assessment
DE.AE-5 DE.AE-5 Incident alert thresholds defined in the incident response plan
DE.CM-1 DE.CM-1 Continuous monitoring of conduit ingress and egress, extending into zones at higher profiles
DE.CM-2 DE.CM-2 Physical security events coordinated into IAC monitoring
DE.CM-4 DE.CM-4 Malware risk assessed per environment and detection deployed and updated per vendor practice

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All API 1164 controls