Frameworks / NIST SP 800-53 Revision 5.1 HIGH / SI-4 NIST SP 800-53 Revision 5.1 HIGH
SI System Information Integrity
NIST SP 800-53 Revision 5.1 HIGH SI-4: System Monitoring Monitor system to detect attacks; identify unauthorized use; deploy monitoring devices at boundaries and key internal points.
What else in your programme already covers this This control maps to 64 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
10.2.1 Audit logs enabled on system components 10.2.1.2 Log all admin actions 10.4.1 Daily log review for critical systems 10.4.3 Exceptions and anomalies addressed 10.7.1 Critical security control failure detection (SP) 10.7.2 Critical security control failure detection (all entities) 11.2.1 Wireless AP detection 11.5.1 IDS/IPS in place 12.10.5 IRP includes monitoring and response to security control alerts 5.3.4 Audit logs for anti-malware enabled CIS-13.1 Centralize Security Event Alerting CIS-13.2 Deploy a Host-Based Intrusion Detection Solution CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-13.6 Collect Network Traffic Flow Logs CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS-8.11 Conduct Audit Log Reviews CIS-8.2 Collect Audit Logs NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.AE-03 Information is correlated from multiple sources NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events NIST-CSF-ID.RA-03 Internal and external threats to the organization are identified and recorded NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring ASBv3-DS-7 Enable logging and monitoring in DevOps ASBv3-LT-1 Enable threat detection capabilities ASBv3-LT-2 Enable threat detection for identity and access management ASBv3-NS-4 Deploy intrusion detection/intrusion prevention systems (IDS/IPS) DP-2 Monitor anomalies and threats targeting sensitive data ASD37-29 Host-based IDS/IPS (Very Good) ASD37-30 Endpoint detection and response (Very Good) ASD37-32 Network-based IDS/IPS (Limited) ASD37-33 Capture network traffic (Limited) C5-COS-01 Technical safeguards C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-OPS-13 Logging and Monitoring - Identification of Events SOC2-CC6.6 Measures against threats outside system boundaries are implemented SOC2-CC7.1 Detection and monitoring procedures for security events are in place SOC2-CC7.2 Monitors system components for anomalies indicating malicious acts SEC04-BP01 Configure service and application logging SEC05-BP03 Implement inspection-based protection CBPR-PR-32 Detection, prevention and response measures 8.16 Monitoring activities 8.16 Monitoring activities 3.14.2e Monitor Organizational Systems with Specialized Capabilities Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in SI System Information Integrity Query this from an agent The graph holds this control, the 64 it maps to, and the evidence behind each claim, over MCP and REST.