Logging and monitoring: a process follows every access to the network and to system components. Level 1 (a to h): audit trails of what privileged administrators do on every system and network component; fault logging; logging of changes; event logging; regular review of audit trails for anomalies; logging of identification and authentication use and of initialisation of audit trail files; clock synchronisation; and procedures to monitor use of processing facilities with regular review. Level 2 (a to e): audit trails of all user access; review for individual logical access attempts; logging when system-level objects are created or removed; file-integrity monitoring or change detection on logs to alert on changes to audit trails; and real-time network monitoring with intrusion detection and prevention. Level 3 (a to d): real-time monitoring of critical infrastructure with intrusion detection and prevention, and follow-up, verification and resolution of the alerts raised.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.