Navigate

CCI-002641

CCI-002641 Definition

The organization monitors the information system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed documents and implements a process to monitor the information system to detect attacks and indicators of potential attacks in accordance with sensor placement and monitoring requirements within CJCSI 6510.01F. The organization must maintain an audit trail of monitoring. DoD has defined the monitoring objectives as sensor placement and monitoring requirements within CJCSI 6510.01F.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the information system to detect attacks and indicators of potential attacks in accordance with sensor placement and monitoring requirements within CJCSI 6510.01F.

Compelling Evidence

1.) Signed and dated system security plan that defines objectives of monitoring, sensor placement for monitoring, how monitoring is performed.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002641.

Control	Description
SI-4	The organization: SI-4a.: Monitors the information system to detect: SI-4a.1.: Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and SI-4a.2.: Unauthorized local, network, and remote connections; SI-4b.: Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods]; SI-4c.: Deploys monitoring devices: SI-4c.1.: Strategically within the information system to collect organization-determined essential information; and SI-4c.2.: At ad hoc locations within the system to track specific types of transactions of interest to the organization; SI-4d.: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; SI-4e.: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; SI-4f.: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and SI-4g.: Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].

Control

Description

SI-4

The organization:

SI-4a.: Monitors the information system to detect:
- SI-4a.1.: Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and
- SI-4a.2.: Unauthorized local, network, and remote connections;

SI-4b.: Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods];

SI-4c.: Deploys monitoring devices:
- SI-4c.1.: Strategically within the information system to collect organization-determined essential information; and
- SI-4c.2.: At ad hoc locations within the system to track specific types of transactions of interest to the organization;

SI-4d.: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;

SI-4e.: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;

SI-4f.: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and

SI-4g.: Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].