Agencies should: characterise every server whose function is critical to the agency or that is judged at high risk of compromise; hold the characterisation data securely away from the server in a way that preserves its integrity; refresh the characterisation after each legitimate system change through change control; as part of the ongoing audit schedule, compare stored against current characterisation to detect a compromise or a legitimate change that was completed incorrectly; where possible, perform characterisation from a trusted environment instead of the normal operating system; and handle any changes detected through the agency's information security incident management procedures.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.