SM-13—Security Monitoring Alert Criteria Review

>Control Description

Organization reviews security monitoring alert on an annual basis.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Document Organization's Security Monitoring Standard to include requirements for security monitoring alert criteria. 2. Establish a process to ensure that the monitoring tool is configured to review the security alerts on an annual basis by the authorized personnel.

>Testing Procedure

1. Inspect Organization's Security Monitoring Standard to determine whether requirements for security monitoring alert criteria are defined. 2. For a sample of alert rules from a sample of services, inspect the monitoring tool configuration to determine that security alerts are reviewed on an annual basis by the authorized personnel.