SM-12—Security Monitoring Alert Criteria
>Control Description
Organization defines security monitoring alert criteria, how alert criteria will be flagged, and identifies authorized personnel for flagged system alerts.
Theme
Process
Type
Detective
Policy/Standard
Logging & Monitoring Standard>Implementation Guidance
1. Document Organization's Security Monitoring Standard to include requirements for security monitoring alert criteria. 2. Establish a process to periodically review and maintain a list of security monitoring rules.
>Testing Procedure
1. Inspect Organization's Security Monitoring Standard to determine whether requirements for security monitoring alert criteria are defined. 2. Obtain list of security monitoring rules that are defined. 3. For a sample of alert rules from a sample of services, inspect the monitoring tool configuration to determine that rules are implemented to flag events, and notify authorized personnel.
>Audit Artifacts
E-SM-10
E-SM-11
E-SM-12
>Framework Mappings
Cross-framework mappings provided by Adobe CCF Open Source under Creative Commons License.
Ask AI
Configure your API key to use AI features.