SM-22—Security Monitoring Alert Criteria: Privileged Functions

>Control Description

Organization defines security monitoring alert criteria for privileged functions executed by both authorized and unauthorized users.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that Organization's Security Monitoring Standard includes requirements for security monitoring alert criteria for privileged functions executed by both authorized and unauthorized users. 2. Ensure that the security monitoring rules are defined, enabled and alert applicable personnel on privileged functions executed by both authorized and unauthorized users. 3. Ensure that alerts are being generated and sent to the SOC team to support remediation.

>Testing Procedure

1. Inspect Organization's Security Monitoring Standard to determine whether requirements for privileged functions executed by both authorized and unauthorized users. 2. Inspect a sample of security monitoring rules, to validate that the rules are defined to look for and alert applicable personnel on privileged functions executed by both authorized and unauthorized users. 3. Validate that alerts being generated are sent to the SOC team to support remediation.