Skip to main content

πŸ’Ό SI-4(20) Privileged Users (H)

  • Contextual name: πŸ’Ό SI-4(20) Privileged Users (H)
  • ID: /frameworks/fedramp-high-security-controls/si/04/20
  • Located in: πŸ’Ό SI-4 System Monitoring (L)(M)(H)

Description​

Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].

Similar​

  • Sections
    • /frameworks/nist-sp-800-53-r5/si/04/20
  • Internal
    • ID: dec-c-5e13e85f

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-4(20) System Monitoring _ Privileged Users3

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (48)​

PolicyLogic CountFlags
πŸ“ AWS Account Config is not enabled in all regions 🟒1🟒 x6
πŸ“ AWS Account IAM Access Analyzer is not enabled for all regions 🟒1🟒 x6
πŸ“ AWS Account Multi-Region CloudTrail is not enabled 🟒1🟒 x6
πŸ“ AWS Account Root User credentials were used is the last 30 days πŸ”΄πŸŸ’1πŸ”΄ x1, 🟒 x6
πŸ“ AWS Account Security Hub is not enabled 🟒1🟠 x1, 🟒 x5
πŸ“ AWS API Gateway API Access Logging in CloudWatch is not enabled 🟒1🟠 x1, 🟒 x5
πŸ“ AWS API Gateway API Execution Logging in CloudWatch is not enabled 🟒1🟒 x6
πŸ“ AWS API Gateway REST API Stage X-Ray Tracing is not enabled 🟒1🟒 x6
πŸ“ AWS CloudTrail AWS Organizations Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Config Configuration Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Configuration Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Disable CMK or Schedule CMK Deletion Events Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail IAM Policy Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Management Console Authentication Failures Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Management Console Sign-In without MFA Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Network Access Control Lists Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Network Gateways Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Root Account Usage Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Route Table Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail S3 Bucket Access Logging is not enabled. 🟒1🟒 x6
πŸ“ AWS CloudTrail S3 Bucket Policy Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Security Group Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail Unauthorized API Calls Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS CloudTrail VPC Changes Monitoring is not enabled 🟒🟒 x3
πŸ“ AWS S3 Bucket Server Access Logging is not enabled 🟒1🟒 x6
πŸ“ AWS VPC Flow Logs are not enabled 🟒1🟠 x1, 🟒 x5
πŸ“ Azure Diagnostic Setting captures Administrative, Alert, Policy, and Security categories 🟒1🟒 x6
πŸ“ Azure Diagnostic Setting for Azure Key Vault is not enabled 🟒🟒 x3
πŸ“ Azure Network Security Group Flow Logs retention period is less than 90 days 🟒1🟒 x6
πŸ“ Azure PostgreSQL Flexible Server log_checkpoints Parameter is not set to ON 🟒1🟒 x6
πŸ“ Azure PostgreSQL Flexible Server log_retention_days Parameter is less than 4 days 🟒1🟒 x6
πŸ“ Azure PostgreSQL Single Server log_connections Parameter is not set to ON 🟒1🟒 x6
πŸ“ Azure PostgreSQL Single Server log_disconnections Parameter is not set to ON 🟒1🟒 x6
πŸ“ Azure SQL Server Auditing is not enabled 🟒1🟒 x6
πŸ“ Azure SQL Server Auditing Retention is less than 90 days 🟒1🟒 x6
πŸ“ Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests 🟒1🟒 x6
πŸ“ Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Create or Update Network Security Group does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Create or Update Security Solution does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Create or Update SQL Server Firewall Rule does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Create Policy Assignment does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Delete Network Security Group does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Delete Policy Assignment does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Delete Security Solution does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Activity Log Alert for Delete SQL Server Firewall Rule does not exist 🟒1🟒 x6
πŸ“ Azure Subscription Security Alert Notifications additional email address is not configured 🟒1🟒 x6
πŸ“ Azure Subscription Security Alert Notifications for alerts with High severity are not configured 🟒1🟒 x6
πŸ“ Azure Subscription Security Alert Notifications to subscription owners are not configured 🟒1🟒 x6

Internal Rules​

RulePoliciesFlags
βœ‰οΈ dec-x-0c82d7751
βœ‰οΈ dec-x-0ef94ece1
βœ‰οΈ dec-x-2ac6c3021
βœ‰οΈ dec-x-02eed49a1
βœ‰οΈ dec-x-3cfa53061
βœ‰οΈ dec-x-6fc9c9491
βœ‰οΈ dec-x-9b3ad9c41
βœ‰οΈ dec-x-9b79d91f1
βœ‰οΈ dec-x-9c0416671
βœ‰οΈ dec-x-9dc820141
βœ‰οΈ dec-x-20c9ef831
βœ‰οΈ dec-x-24bba4831
βœ‰οΈ dec-x-36ced3d11
βœ‰οΈ dec-x-42eac3871
βœ‰οΈ dec-x-43f99d791
βœ‰οΈ dec-x-52ca19601
βœ‰οΈ dec-x-66cf8b151
βœ‰οΈ dec-x-88fa51c81
βœ‰οΈ dec-x-89d5ed7a1
βœ‰οΈ dec-x-351e376f1
βœ‰οΈ dec-x-611eaa351
βœ‰οΈ dec-x-1518c16e1
βœ‰οΈ dec-x-79579ed71
βœ‰οΈ dec-x-82388e101
βœ‰οΈ dec-x-9002886f1
βœ‰οΈ dec-x-a27f40931
βœ‰οΈ dec-x-a193b20f1
βœ‰οΈ dec-x-ab7fc52e1
βœ‰οΈ dec-x-b2ce0ca11
βœ‰οΈ dec-x-b05799ff1
βœ‰οΈ dec-x-b10287411
βœ‰οΈ dec-x-ba4c5b1c1
βœ‰οΈ dec-x-c4cc9ff51
βœ‰οΈ dec-x-c397d3ca2
βœ‰οΈ dec-x-d75f6d861
βœ‰οΈ dec-x-db1b7a1b1
βœ‰οΈ dec-x-dc359e591
βœ‰οΈ dec-x-e5c05d3e1
βœ‰οΈ dec-x-e6b90a421
βœ‰οΈ dec-x-e9ae2d3d1
βœ‰οΈ dec-x-e58fd8e01
βœ‰οΈ dec-x-e00143332
βœ‰οΈ dec-x-e29738211
βœ‰οΈ dec-x-f70dd11f1
βœ‰οΈ dec-z-3f480eb51
βœ‰οΈ dec-z-bc139af81