SI-4—System Monitoring

>Control Description

Monitor the system to detect:

Attacks and indicators of potential attacks in accordance with the following monitoring objectives: ⚙organization-defined monitoring objectives; and

Unauthorized local, network, and remote connections;

Identify unauthorized use of the system through the following techniques and methods: ⚙organization-defined techniques and methods;

Invoke internal monitoring capabilities or deploy monitoring devices:

Strategically within the system to collect organization-determined essential information; and

At ad hoc locations within the system to track specific types of transactions of interest to the organization;

Analyze detected events and anomalies;

Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;

Obtain legal opinion regarding system monitoring activities; and

Provide ⚙organization-defined system monitoring information to ⚙organization-defined personnel or roles [Selection (one or more): as needed; ⚙organization-defined frequency].