SM-28—Privileged Session Monitoring

>Control Description

Organization monitors trusted data environments for unauthorized logical access connections.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that Organization's Security Monitoring standard includes the requirements for session monitoring. 2. Configure monitoring tool to ensure least privileged principle is followed. 3. Ensure that the organization monitors trusted data environments for unauthorized logical access connections.

>Testing Procedure

1. Inspect Organization's Security Monitoring standard to determine whether the requirements for session monitoring are defined. 2. Inspect configurations of monitoring tool to ensure least privileged principle is followed. 3. Inspect evidence of the Organization monitoring trusted data environments for unauthorized logical access connections.