FCEB agencies provide CISA with data from their endpoint detection and response solutions and security operation centers of the completeness and on the timeline the CISA concept of operations requires, either by CISA's direct access to the agency's EDR (with advance notice to the agency) or, for the use cases the concept of operations names, by providing telemetry, so that CISA can hunt for threats and vulnerabilities across the Federal civilian enterprise, identify coordinated campaigns moving laterally between agencies and coordinate Government-wide incident analysis under 44 U.S.C. 3553(b)(7).
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.