CCI-001671

Analyze outbound communications traffic at selected organization-defined interior points within the system to discover anomalies.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to analyze outbound communications traffic at selected interior points defined in SI-4 (11), CCI 2668 within the system (e.g., subnetworks, subsystems) to discover anomalies. The organization must maintain a record of any discovered anomalies.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of any discovered anomalies to ensure the organization being inspected/assessed analyzes outbound communications traffic at selected interior points defined in SI-4 (11), CCI 2668 within the system (e.g., subnetworks, subsystems) to discover anomalies.

Compelling Evidence

1.) Signed and dated system security plan references a process to analyze outbound communications traffic at selected interior points defined in SI-4 (11), CCI 2668 within the system (e.g., subnetworks, subsystems) to discover anomalies. 2.) List of any discovered anomalies

The controls below (if any) were marked by NIST as being related to CCI-001671.