Frameworks / CIS Controls v8 / CIS-13.1 CIS Controls v8
CIS Control 13: Network Monitoring and Defense
CIS Controls v8 CIS-13.1: Centralize Security Event Alerting Bring security event alerting from enterprise assets into one place so logs can be correlated and analysed. Good practice calls for a SIEM with vendor-defined correlation alerts; a log analytics platform set up with correlation alerts relevant to security also meets this Safeguard.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 124 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AC-2(12) Account Monitoring for Atypical Usage AU-5 Response to Audit Logging Process Failures AU-6 Audit Record Review, Analysis, and Reporting AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7(1) Automatic Processing CA-7 Continuous Monitoring CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4)) IR-1 Policy and Procedures IR-2 Incident Response Training IR-4(1) Automated Incident Handling Processes IR-5 Incident Monitoring IR-6(1) Automated Reporting IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) SA-2 Allocation of Resources SI-4 System Monitoring SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1)) SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis SI-4(5) System-Generated Alerts SI-5 Security Alerts, Advisories, and Directives SI-7(7) Integration of Detection and Response AC-2(12) Account Monitoring for Atypical Usage AU-5 Response to Audit Logging Process Failures AU-6 Audit Record Review, Analysis, and Reporting AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7(1) Automatic Processing CA-7 Continuous Monitoring CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4)) IR-1 Policy and Procedures IR-2 Incident Response Training IR-4(1) Automated Incident Handling Processes IR-5 Incident Monitoring IR-6(1) Automated Reporting IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) SA-2 Allocation of Resources SI-4 System Monitoring SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1)) SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis SI-4(5) System-Generated Alerts SI-5 Security Alerts, Advisories, and Directives SI-7(7) Integration of Detection and Response NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.AE-03 Information is correlated from multiple sources NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved NIST-CSF-RS.MA-02 Incident reports are triaged and validated NIST-CSF-RS.MA-03 Incidents are categorized and prioritized 10.3.3 10.3.3 Audit logs promptly backed up to central secure storage 10.4.1.1 10.4.1.1 Automated mechanisms used for audit log review 10.7.1 10.7.1 Service providers detect critical control failures (superseded) 10.7.2 10.7.2 Detect and alert on critical security control failures 10.7.3 10.7.3 Respond promptly to critical security control failures 12.10.5 12.10.5 Plan covers alerts from security monitoring systems 12.10.7 12.10.7 Response procedures for PAN found in unexpected locations ASBv3-IR-4 Detection and analysis - investigate an incident ASBv3-LT-1 Enable threat detection capabilities ASBv3-LT-2 Enable threat detection for identity and access management LT-5 Centralize security log management and analysis 5.25 Assessment and decision on information security events 5.26 Response to information security incidents 8.15 Logging 8.16 Monitoring activities 5.25 Assessment and decision on information security events 5.7 Threat intelligence 8.15 Logging 8.16 Monitoring activities SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches ASD37-28 Continuous incident detection and response (Excellent) ASD37-31 Hunt to discover incidents (Very Good) SEC04-BP02 Capture logs, findings, and metrics in standardized locations SEC04-BP03 Correlate and enrich security alerts C5-OPS-13 Logging and Monitoring - Identification of Events C5-OPS-16 Logging and Monitoring - Configuration 5.7.1 Monitoring, measurement, analysis and evaluation 6.9.4 Logging and monitoring 3.14.2e Monitor Organizational Systems with Specialized Capabilities 3.6.1e Establish Security Operations Center (SOC) E8-APP-ML2 Application Control (ML2) ISM-1405 Implementing a centralised event logging facility A.6.2.6 AI system operation and monitoring Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CIS Control 13: Network Monitoring and Defense You are reading one control. How much of CIS Controls v8 have you already done? CIS Controls v8 CIS-13.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 124 it maps to, and the evidence behind each claim, over MCP and REST.