CCI-001276

Implementation Guidance

The organization being inspected/assessed documents and implements a process to analyze communications traffic/event patterns for the information system. The organization must maintain a record of the analysis.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of analysis to ensure the organization being inspected/assessed analyzes communications traffic/event patterns for the information system.

Compelling Evidence

1.) Signed and dated system security plan references a process to analyze communications traffic/event patterns for the information system. 2.) Record of the analysis.