💼 SI-4 System Monitoring (L)(M)(H)

• ID: /frameworks/fedramp-high-security-controls/si/04

Description

a. Monitor the system to detect:

1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and

2. Unauthorized local, network, and remote connections;

b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];

c. Invoke internal monitoring capabilities or deploy monitoring devices:

1. Strategically within the system to collect organization-determined essential information; and

2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;

d. Analyze detected events and anomalies;

e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;

f. Obtain legal opinion regarding system monitoring activities; and

g. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one-or-more): as needed; [Assignment: organization-defined frequency]].

SI-4 Additional FedRAMP Requirements and Guidance:

Guidance: See US-CERT Incident Response Reporting Guidelines.

Similar

• Sections
  • /frameworks/nist-sp-800-53-r5/si/04
• Internal
  • ID: dec-c-d2e87396

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring	25	1	10		no data

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)			8		no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)	7		10		no data

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 SI-4(1) System-wide Intrusion Detection System (M)(H)		1	2		no data
💼 SI-4(2) Automated Tools and Mechanisms for Real-time Analysis (M)(H)			1		no data
💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)		6	8		no data
💼 SI-4(5) System-generated Alerts (M)(H)			2		no data
💼 SI-4(10) Visibility of Encrypted Communications (H)					no data
💼 SI-4(11) Analyze Communications Traffic Anomalies (H)					no data
💼 SI-4(12) Automated Organization-generated Alerts (H)			1		no data
💼 SI-4(14) Wireless Intrusion Detection (H)					no data
💼 SI-4(16) Correlate Monitoring Information (M)(H)					no data
💼 SI-4(18) Analyze Traffic and Covert Exfiltration (M)(H)					no data
💼 SI-4(19) Risk for Individuals (H)					no data
💼 SI-4(20) Privileged Users (H)		48	51		no data
💼 SI-4(22) Unauthorized Network Services (H)			1		no data
💼 SI-4(23) Host-based Devices (M)(H)					no data

Policies (8)

Policy	Logic Count	Flags	Compliance
🛡️ AWS CloudTrail Log File Validation is not enabled🟢	1	🟢 x6	no data
🛡️ AWS GuardDuty is not enabled in all regions🟢	1	🟢 x6	no data
🛡️ Azure PostgreSQL Flexible Server connection_throttle.enable Parameter is not set to ON🟢	1	🟢 x6	no data
🛡️ Azure SQL Server Auditing is not enabled🟢	1	🟢 x6	no data
🛡️ Azure SQL Server Auditing Retention is less than 90 days🟢	1	🟢 x6	no data
🛡️ Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests🟢	1	🟢 x6	no data
🛡️ Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests🟢	1	🟢 x6	no data
🛡️ Google GCE Subnetwork Flow Logs are not enabled🟢	1	🟢 x6	no data

Internal Rules

Rule	Policies	Flags
✉️ dec-x-36ced3d1	1
✉️ dec-x-89d5ed7a	1
✉️ dec-x-611eaa35	1
✉️ dec-x-850beea8	1
✉️ dec-x-b1e1a494	1
✉️ dec-x-db1b7a1b	1