CCI-001260

Implementation Guidance

The organization being inspected/assessed documents and implements automated tools to support near real-time analysis of events.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated tools to ensure the organization being inspected/assessed employs automated tools to support near real-time analysis of events. The organization being inspected/assessed may be required to demonstrate use of their automated tools.

Compelling Evidence

1.) Signed and dated system security plan documents what automated tools are used to support near real-time analysis of events. It must also cover configuration baseline for those automated tools. 2.) Logs of automated tools.