CCI-004248

Defines the automated mechanisms for recognizing organization-defined classes or types of intrusions and initiating organization-defined response actions.

Implementation Guidance

Determine if: - [PE-06(02)_ODP[01]; classes or types of intrusions to be recognized by automated mechanisms are defined] are recognized. - [PE-06(02)_ODP[02]; response actions to be initiated by automated mechanisms when organization-defined classes or types of intrusions are recognized are defined] are initiated using [PE-06(02)_ODP[03]; automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined].

Validation Procedures

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing physical access monitoring; system design documentation; system configuration settings and associated documentation; system audit records; list of response actions to be initiated when specific classes/types of intrusions are recognized; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with physical access monitoring responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for monitoring physical access; automated mechanisms supporting and/or implementing physical access monitoring; automated mechanisms supporting and/or implementing recognition of classes/types of intrusions and initiation of a response].

The controls below (if any) were marked by NIST as being related to CCI-004248.