CCI-002641

Monitor the system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to monitor the information system to detect attacks and indicators of potential attacks in accordance with sensor placement and monitoring requirements within CJCSI 6510.01F. The organization must maintain an audit trail of monitoring. DoD has defined the monitoring objectives as sensor placement and monitoring requirements within CJCSI 6510.01F.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the information system to detect attacks and indicators of potential attacks in accordance with sensor placement and monitoring requirements within CJCSI 6510.01F.

Compelling Evidence

1.) Signed and dated system security plan that defines objectives of monitoring, sensor placement for monitoring, how monitoring is performed.

The controls below (if any) were marked by NIST as being related to CCI-002641.