CCI-002643

Implementation Guidance

The organization being inspected/assessed documents and implements a process to monitor the information system to detect unauthorized network connections. The organization must maintain an audit trail of monitoring.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the information system to detect unauthorized network connections.

Compelling Evidence

1.) Signed and dated system security plan with reference to section pertaining to how unauthorized network connections are detected via monitoring software. 2.) Complete audit logs and protection software logs.