Lexim011/Compliance huggingface dataset:
CCI-002562 (policy): Monitor the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-43 b NIST: NIST SP 800-53 Revision 5 (v5): SC-43 b
CCI-002563 (policy): Control the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-43 b NIST: NIST SP 800-53 Revision 5 (v5): SC-43 b
CCI-002564 (policy): Defines the system, system component, or location where a detonation chamber capability is employed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-44 NIST: NIST SP 800-53 Revision 5 (v5): SC-44
CCI-002565 (policy): Employ a detonation chamber capability within an organization-defined system, system component, or location.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-44 NIST: NIST SP 800-53 Revision 5 (v5): SC-44
CCI-004922 (technical): Synchronize system clocks within and between systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45
CCI-004923 (technical): Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (a)
CCI-004924 (technical): Defines the frequency for comparing the internal system clocks with organization-defined authoritative time source.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (a)
CCI-004925 (technical): Defines the time source used for comparing the internal system clocks.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (a)
CCI-004926 (technical): Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (b)
CCI-004927 (technical): Defines the time period for synchronizing the internal system clocks to the authoritative time source.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (b)
CCI-004928 (technical): Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (2) (a)
CCI-004929 (technical): Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (2) (b)
CCI-004930 (technical): Implement a policy enforcement mechanism physically or logically between the physical and/or network interfaces for the connecting security domains.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-46
CCI-004931 (policy, technical): Establish organization-defined alternate communications paths for system operations organizational command and control.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-47
CCI-004932 (policy, technical): Relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48
CCI-004933 (policy): Defines the sensors and monitoring capabilities to be relocated to organization-defined locations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48
CCI-004934 (policy): Defines the locations of which the organization-defined sensors and monitoring capabilities will be relocated.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48
CCI-004935 (policy): Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are relocated.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48
CCI-004936 (policy, technical): Dynamically relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1)
CCI-004937 (policy): Defines the sensors and monitoring capabilities to be dynamically relocated to organization-defined locations.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1)
CCI-004938 (policy): Defines the locations of which the organization-defined sensors and monitoring capabilities will be dynamically relocated.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1)
CCI-004939 (policy): Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are dynamically relocated.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1)
CCI-004940 (policy, technical): Implement hardware-enforced separation and policy enforcement mechanisms between organization-defined security domains.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-49
CCI-004941 (policy): Defines the security domains for implementing hardware-enforced separation and policy enforcement mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-49
CCI-004942 (policy, technical): Implement software-enforced separation and policy enforcement mechanisms between organization-defined security domains.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-50
CCI-004943 (policy): Defines the security domains for implementing software-enforced separation and policy enforcement mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-50
CCI-002508 (policy): Defines the system firmware components for which hardware-based, write-protect is employed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SC-51 a
CCI-002509 (policy): Employ hardware-based, write-protect for organization-defined information system firmware components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SC-51 a
CCI-002510 (policy): Defines the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SC-51 b
CCI-002511 (policy): Implement specific procedures for organization-defined authorized individuals to manually disable hardware-based, write-protect for firmware modifications.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SC-51 b
CCI-002512 (policy): Implement specific procedures for organization-defined authorized individuals to manually re-enable hardware write-protect prior to returning to operational mode.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SC-51 b
CCI-002523 (policy): Defines the individuals or systems authorized to be recipients of organization-defined information, system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 NIST: NIST SP 800-53 Revision 5 (v5): SC-37, SC-37 (1)
CCI-001217 (policy): Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): SI-1 a NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 1 (a) NIST: NIST SP 800-53A (v1): SI-1.1 (i) (ii)
CCI-001218 (policy): Disseminate an organization-level; mission/business process-level; and/or system level system and information integrity policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): SI-1 a NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 1 NIST: NIST SP 800-53A (v1): SI-1.1 (iii)
CCI-001220 (policy): Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system level system and information integrity policy and associated system integrity controls.
References: NIST: NIST SP 800-53 (v3): SI-1 b NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 2 NIST: NIST SP 800-53A (v1): SI-1.1 (iv) (v)
CCI-001221 (policy): Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls.
References: NIST: NIST SP 800-53 (v3): SI-1 b NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 2 NIST: NIST SP 800-53A (v1): SI-1.1 (vi)
CCI-002601 (policy): Defines the personnel or roles to whom the system and information integrity policy and procedures are to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a
CCI-004944 (policy): Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 1 (b)
CCI-004945 (policy): Designate an organization-defined official to manage the development and documentation of the system and information integrity policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b
CCI-004946 (policy): Designate an organization-defined official to manage the dissemination of the system and information integrity policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b
CCI-004947 (policy): Designate an organization-defined official to manage the development and documentation of the system and information integrity procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b
CCI-004948 (policy): Designate an organization-defined official to manage the dissemination of the system and information integrity procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b
CCI-004949 (policy): Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b
CCI-004950 (policy): Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b
CCI-001219 (policy): Review and update the current system and information integrity policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SI-1 a NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1 NIST: NIST SP 800-53A (v1): SI-1.2 (ii)
CCI-001222 (policy): Review and update the current system and information integrity procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SI-1 b NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2 NIST: NIST SP 800-53A (v1): SI-1.2 (iv)
CCI-001223 (policy): Defines the frequency for reviewing and updating the current system and information integrity policy.
References: NIST: NIST SP 800-53 (v3): SI-1 a NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1 NIST: NIST SP 800-53A (v1): SI-1.2 (i)
CCI-001224 (policy): Defines the frequency for reviewing and updating the current system and information integrity procedures.
References: NIST: NIST SP 800-53 (v3): SI-1 b NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2 NIST: NIST SP 800-53A (v1): SI-1.2 (iii)
CCI-004951 (policy): Review and update the current system and information integrity policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1
CCI-004952 (policy): Defines the events following reviewing and updating the current system and information integrity policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1
CCI-004953 (policy): Review and update the current system and information integrity procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2
CCI-004954 (policy): Defines the events following reviewing and updating the current system and information integrity procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2
CCI-001225 (policy): Identify system flaws.
References: NIST: NIST SP 800-53 (v3): SI-2 a NIST: NIST SP 800-53 Revision 4 (v4): SI-2 a NIST: NIST SP 800-53 Revision 5 (v5): SI-2 a NIST: NIST SP 800-53A (v1): SI-2.1 (i)
CCI-001226 (policy): Report system flaws.
References: NIST: NIST SP 800-53 (v3): SI-2 a NIST: NIST SP 800-53 Revision 4 (v4): SI-2 a NIST: NIST SP 800-53 Revision 5 (v5): SI-2 a NIST: NIST SP 800-53A (v1): SI-2.1 (i)
CCI-001227 (policy): Correct system flaws.
References: NIST: NIST SP 800-53 (v3): SI-2 a NIST: NIST SP 800-53 Revision 4 (v4): SI-2 a NIST: NIST SP 800-53 Revision 5 (v5): SI-2 a NIST: NIST SP 800-53A (v1): SI-2.1 (i)
CCI-001228 (policy): Test software updates related to flaw remediation for effectiveness before installation.
References: NIST: NIST SP 800-53 (v3): SI-2 b NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b NIST: NIST SP 800-53A (v1): SI-2.1 (ii)
CCI-001229 (policy): Test software updates related to flaw remediation for potential side effects before installation.
References: NIST: NIST SP 800-53 (v3): SI-2 b NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b NIST: NIST SP 800-53A (v1): SI-2.1 (iii)
CCI-002602 (policy): Test firmware updates related to flaw remediation for effectiveness before installation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b
CCI-002603 (policy): Test firmware updates related to flaw remediation for potential side effects before installation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b
CCI-002604 (policy): Defines the time period following the release of updates within which security-related software updates are to be installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c
CCI-002605 (technical): Install security-relevant software updates within an organization-defined time period of the release of the updates.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c
CCI-002606 (policy): Defines the time period following the release of updates within which security-related firmware updates are to be installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c
CCI-002607 (technical): Install security-relevant firmware updates within an organization-defined time period of the release of the updates.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c
CCI-001230 (policy): Incorporate flaw remediation into the organizational configuration management process.
References: NIST: NIST SP 800-53 (v3): SI-2 c NIST: NIST SP 800-53 Revision 4 (v4): SI-2 d NIST: NIST SP 800-53 Revision 5 (v5): SI-2 d NIST: NIST SP 800-53A (v1): SI-2.1 (iv)
CCI-004955 (policy): Determine if system components have applicable security-related software updates installed using organization-defined mechanisms on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2)
CCI-004956 (policy): Determine if system components have applicable security-related firmware updates installed using organization-defined mechanisms on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2)
CCI-004957 (policy): Defines a frequency for installing security-relevant software updates using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2)
CCI-004958 (policy): Defines a frequency for installing security-relevant firmware updates using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2)
CCI-004959 (policy): Defines the automated mechanisms for determining if system components have applicable security-related software updates installed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2)
CCI-004960 (policy): Defines the automated mechanisms for determining if system components have applicable security-related firmware updates installed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2)
CCI-001235 (policy): Measure the time between flaw identification and flaw remediation.
References: NIST: NIST SP 800-53 (v3): SI-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (3) (a) NIST: NIST SP 800-53A (v1): SI-2 (3).1 (ii)
CCI-001236 (policy): Defines benchmarks for the time taken to apply corrective actions after flaw identification.
References: NIST: NIST SP 800-53 (v3): SI-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (3) (b) NIST: NIST SP 800-53A (v1): SI-2 (3).1 (i)
CCI-002608 (policy): Establish organization-defined benchmarks for the time taken to apply corrective actions after flaw identification.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (3) (b)
CCI-004961 (policy, technical): Employ automated patch management tools to facilitate flaw remediation to the organization-defined system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (4)
CCI-004962 (policy): Defines the system components on which patch management tools to facilitate flaw remediation are employed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (4)
CCI-002609 (policy): Defines the system components on which organization-defined security-relevant software updates will be automatically installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5)
CCI-002610 (policy): Defines the system components on which organization-defined security-relevant firmware updates will be automatically installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5)
CCI-002611 (policy): Defines the security-relevant software updates to be automatically installed on organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5)
CCI-002612 (policy): Defines the security-relevant firmware updates to be automatically installed on organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5)
CCI-002613 (technical): Install organization-defined security-relevant software updates automatically to organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5)
CCI-002614 (technical): Install organization-defined security-relevant firmware updates automatically to organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5)
CCI-002615 (policy): Defines the software components to remove previous versions after updated versions have been installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6)
CCI-002616 (policy): Defines the firmware components to remove previous versions after updated versions have been installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6)
CCI-002617 (technical): Remove previous versions of organization-defined software components after updated versions have been installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6)
CCI-002618 (technical): Remove previous versions of organization-defined firmware components after updated versions have been installed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6)
CCI-004963 (policy, technical): Implement signature based and/or non-signature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-3 a
CCI-004964 (policy): Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-3 b
CCI-004965 (policy): Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-3 b
CCI-001241 (technical): Configure malicious code protection mechanisms to perform periodic scans of the system on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SI-3 c NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 1 NIST: NIST SP 800-53A (v1): SI-3.1 (vi)
CCI-001243 (technical): Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.
References: NIST: NIST SP 800-53 (v3): SI-3 c NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 2 NIST: NIST SP 800-53A (v1): SI-3.1 (vi)
CCI-001244 (policy): Defines one or more actions to perform in response to malicious code detection, such as blocking malicious code, quarantining malicious code, or sending alerts to administrators.
References: NIST: NIST SP 800-53 (v3): SI-3 c NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 2 NIST: NIST SP 800-53A (v1): SI-3.1 (v)
CCI-002623 (policy): Defines the frequency for performing periodic scans of the system for malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 1
CCI-002624 (policy): Configure malicious code protection mechanisms to perform real-time scans of files from external sources at endpoint; and/or network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 1
CCI-004966 (policy, technical): Configure malicious code protection mechanisms to send alerts to organization-defined personnel in response to malicious code detection.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 2
CCI-001245 (policy): Address the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the system.
References: NIST: NIST SP 800-53 (v3): SI-3 d NIST: NIST SP 800-53 Revision 4 (v4): SI-3 d NIST: NIST SP 800-53 Revision 5 (v5): SI-3 d NIST: NIST SP 800-53A (v1): SI-3.1 (vii)
CCI-001249 (technical): Update malicious code protection mechanisms only when directed by a privileged user.
References: NIST: NIST SP 800-53 (v3): SI-3 (4) NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (4) NIST: NIST SP 800-53A (v1): SI-3 (4).1
CCI-001251 (policy): Test malicious code protection mechanisms on an organization-defined frequency by introducing a known benign code into the system.
References: NIST: NIST SP 800-53 (v3): SI-3 (6) NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (a) NIST: NIST SP 800-53A (v1): SI-3 (6).1 (ii)
CCI-001669 (policy): Defines the frequency of testing malicious code protection mechanisms.
References: NIST: NIST SP 800-53 (v3): SI-3 (6) NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (a) NIST: NIST SP 800-53A (v1): SI-3 (6).1 (i)
CCI-002625 (policy): When testing malicious code protection mechanisms, verify the detection of the code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (b)
CCI-002626 (policy): When testing malicious code protection mechanisms, verify the associated incident reporting of the code occurs.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (b)
CCI-002628 (policy): Defines the unauthorized operating system commands that are to be detected through the kernel application programming interface on organization-defined system hardware components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (a)
CCI-002629 (policy): Defines the system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel programming application interface.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (a)
CCI-002630 (technical): Detect organization-defined unauthorized operating system commands through the kernel application programming interface at organization-defined system hardware components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (a)
CCI-002631 (technical): Issue a warning; audit the command execution; and/or prevent the execution of the command when organization-defined unauthorized operating system commands are detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (b)
CCI-002634 (policy): Defines the tools to be employed to analyze the characteristics and behavior of malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a)
CCI-002635 (policy): Defines the techniques to be employed to analyze the characteristics and behavior of malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a)
CCI-002636 (policy): Employ organization-defined tools to analyze the characteristics and behavior of malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a)
CCI-002638 (policy): Employ organization-defined techniques to analyze the characteristics and behavior of malicious code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a)
CCI-002639 (policy): Incorporate the results from malicious code analysis into organizational incident response processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (b)
CCI-002640 (policy): Incorporate the results from malicious code analysis into organizational flaw remediation processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (b)
CCI-001253 (policy): Defines the objectives of monitoring for attacks and indicators of potential attacks on the system.
References: NIST: NIST SP 800-53 (v3): SI-4 a NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 1 NIST: NIST SP 800-53A (v1): SI-4.1 (i)
CCI-002641 (policy): Monitor the system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 1 NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 1
CCI-002642 (policy): Monitor the system to detect unauthorized local connections.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 2
CCI-002643 (policy): Monitor the system to detect unauthorized network connections.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 2
CCI-002644 (policy): Monitor the system to detect unauthorized remote connections.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 2 NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 2
CCI-002645 (policy): Defines the techniques and methods to be used to identify unauthorized use of the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 b NIST: NIST SP 800-53 Revision 5 (v5): SI-4 b
CCI-002646 (policy): Identify unauthorized use of the system through organization-defined techniques and methods.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 b NIST: NIST SP 800-53 Revision 5 (v5): SI-4 b
CCI-001255 (policy): Invoke internal monitoring capabilities or deploy monitoring devices strategically within the system to collect organization-determined essential information.
References: NIST: NIST SP 800-53 (v3): SI-4 c NIST: NIST SP 800-53 Revision 4 (v4): SI-4 c NIST: NIST SP 800-53 Revision 5 (v5): SI-4 c 1 NIST: NIST SP 800-53A (v1): SI-4.1 (iv)
CCI-001256 (policy): Invoke internal monitoring capabilities or deploy monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.
References: NIST: NIST SP 800-53 (v3): SI-4 c NIST: NIST SP 800-53 Revision 4 (v4): SI-4 c NIST: NIST SP 800-53 Revision 5 (v5): SI-4 c 2 NIST: NIST SP 800-53A (v1): SI-4.1 (iv)
CCI-004967 (policy): Analyze detected events and anomalies.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 d
CCI-001257 (policy): Adjust the level of system monitoring activity when there is a change in increased risk to organizational operations and assets, individuals, other organizations, or the Nation.
References: NIST: NIST SP 800-53 (v3): SI-4 d NIST: NIST SP 800-53 Revision 4 (v4): SI-4 e NIST: NIST SP 800-53 Revision 5 (v5): SI-4 e NIST: NIST SP 800-53A (v1): SI-4.1 (v)
CCI-001258 (policy): Obtain legal opinion with regard to system monitoring activities.
References: NIST: NIST SP 800-53 (v3): SI-4 e NIST: NIST SP 800-53 Revision 4 (v4): SI-4 f NIST: NIST SP 800-53 Revision 5 (v5): SI-4 f NIST: NIST SP 800-53A (v1): SI-4.1 (vi)
CCI-002650 (policy): Defines the system monitoring information that is to be provided the organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g
CCI-002651 (policy): Defines the personnel or roles that are to be provided organization-defined system monitoring information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g
CCI-002652 (policy): Defines the frequency at which the organization will provide the organization-defined system monitoring information to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g
CCI-002654 (policy): Provide organization-defined system monitoring information to organization-defined personnel or roles as needed, and/or per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g
CCI-002655 (policy): Connects individual intrusion detection tools into an system-wide intrusion detection system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (1)
CCI-002656 (technical): Configures individual intrusion detection tools into an system-wide intrusion detection system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (1)
CCI-001260 (policy): Employ automated tools to support near real-time analysis of events.
References: NIST: NIST SP 800-53 (v3): SI-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (2) NIST: NIST SP 800-53A (v1): SI-4 (2).1
CCI-004968 (technical): Employ automated mechanisms to support near real-time analysis of events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (2)
CCI-002657 (policy): Employ automated tools to integrate intrusion detection tools into access control mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3)
CCI-002658 (policy): Employ automated tools to integrate intrusion detection tools into flow control mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3)
CCI-004969 (technical): Employ automated mechanisms to integrate intrusion detection mechanisms into access control mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3)
CCI-004970 (technical): Employ automated mechanisms to integrate intrusion detection mechanisms into flow control mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3)
CCI-004971 (technical): Determine criteria for unusual or unauthorized activities or conditions for inbound communications traffic.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (a)
CCI-004972 (technical): Determine criteria for unusual or unauthorized activities or conditions for outbound communications traffic.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (a)
CCI-002659 (policy): Defines the frequency on which it will monitor inbound communications for unusual or unauthorized activities or conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b)
CCI-002660 (policy): Defines the frequency on which it will monitor outbound communications for unusual or unauthorized activities or conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b)
CCI-002661 (technical): Monitor inbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b)
CCI-002662 (technical): Monitor outbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b)
CCI-004973 (technical): Defines the unusual or unauthorized activities or conditions that will be monitored for inbound communications traffic.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b)
CCI-004974 (technical): Defines the unusual or unauthorized activities or conditions that will be monitored for outbound communications traffic.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b)
CCI-001264 (policy): Defines the indicators of compromise or potential compromise which will result in system alerts being provided to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): SI-4 (5) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (5) NIST: NIST SP 800-53A (v1): SI-4 (5).1 (i)
CCI-002663 (policy): Defines the personnel or roles to receive alerts when organization-defined indicators of compromise or potential compromise occur.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (5)
CCI-002664 (technical): Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (5)
CCI-001266 (technical): Notify an organization-defined incident response personnel (identified by name and/or by role) of detected suspicious events.
References: NIST: NIST SP 800-53 (v3): SI-4 (7) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (a) NIST: NIST SP 800-53A (v1): SI-4 (7).1 (iii)
CCI-001267 (policy): Defines incident response personnel (identified by name and/or by role) to be notified of detected suspicious events.
References: NIST: NIST SP 800-53 (v3): SI-4 (7) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (a) NIST: NIST SP 800-53A (v1): SI-4 (7).1 (i)
CCI-001268 (policy): Defines the least-disruptive actions to be taken by system to terminate suspicious events.
References: NIST: NIST SP 800-53 (v3): SI-4 (7) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (b) NIST: NIST SP 800-53A (v1): SI-4 (7).1 (ii)
CCI-001670 (technical): Take organization-defined least-disruptive actions to terminate suspicious events.
References: NIST: NIST SP 800-53 (v3): SI-4 (7) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (b) NIST: NIST SP 800-53A (v1): SI-4 (7).1 (iv)
CCI-001270 (policy): Test intrusion monitoring tools at an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SI-4 (9) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9) NIST: NIST SP 800-53A (v1): SI-4 (9).1 (ii)
CCI-001271 (policy): Defines the frequency for testing intrusion monitoring tools.
References: NIST: NIST SP 800-53 (v3): SI-4 (9) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9) NIST: NIST SP 800-53A (v1): SI-4 (9).1 (i)
CCI-004975 (policy): Test intrusion monitoring mechanisms at an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9)
CCI-004976 (policy): Defines the frequency for testing intrusion monitoring mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9)
CCI-002665 (policy): Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring tools.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10)
CCI-002666 (policy): Defines the system monitoring tools that will have visibility into organization-defined encrypted communications traffic.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10)
CCI-002667 (policy): Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring tools.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10)
CCI-004977 (policy): Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10)
CCI-004978 (policy): Defines the system monitoring mechanisms that will have visibility into organization-defined encrypted communications traffic.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10)
CCI-004979 (policy): Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10)
CCI-001273 (policy): Analyze outbound communications traffic at the external interfaces to the system to discover anomalies.
References: NIST: NIST SP 800-53 (v3): SI-4 (11) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (11) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (11) NIST: NIST SP 800-53A (v1): SI-4 (11).1
CCI-001671 (policy): Analyze outbound communications traffic at selected organization-defined interior points within the system to discover anomalies.
References: NIST: NIST SP 800-53 (v3): SI-4 (11) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (11) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (11) NIST: NIST SP 800-53A (v1): SI-4 ( 11).1
CCI-002668 (policy): Defines the interior points within the system where outbound communications will be analyzed to discover anomalies.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (11) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (11)
CCI-001274 (policy): Alert organization-defined personnel or roles using organization-defined automated mechanisms when inappropriate or unusual activities with security or privacy implications.
References: NIST: NIST SP 800-53 (v3): SI-4 (12) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (12) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (12) NIST: NIST SP 800-53A (v1): SI-4 (12).1 (ii)
CCI-001275 (policy): Defines the activities which will trigger alerts to security personnel of inappropriate or unusual activities.
References: NIST: NIST SP 800-53 (v3): SI-4 (12) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (12) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (12) NIST: NIST SP 800-53A (v1): SI-4 (12).1 (i)
CCI-004980 (policy): Defines the personnel or roles to receive alerts when indications of inappropriate or unusual activities with security or privacy occur.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (12)
CCI-001276 (policy): Analyze communications traffic and event patterns for the system.
References: NIST: NIST SP 800-53 (v3): SI-4 (13) (a) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (13) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (13) (a) NIST: NIST SP 800-53A (v1): SI-4 (13).1 (i)
CCI-001277 (policy): Develop profiles representing common traffic and event patterns.
References: NIST: NIST SP 800-53 (v3): SI-4 (13) (b) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (13) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (13) (b) NIST: NIST SP 800-53A (v1): SI-4 (13).1 (ii)
CCI-002669 (policy): Use the traffic and event profiles in tuning system-monitoring devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (13) (c) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (13) (c)
CCI-001673 (policy): Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
References: NIST: NIST SP 800-53 (v3): SI-4 (14) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (14) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (14) NIST: NIST SP 800-53A (v1): SI-4 (14).1 (iii)
CCI-001282 (policy): Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
References: NIST: NIST SP 800-53 (v3): SI-4 (15) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (15) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (15) NIST: NIST SP 800-53A (v1): SI-4 (15).1
CCI-001283 (policy): Correlate information from monitoring tools employed throughout the system.
References: NIST: NIST SP 800-53 (v3): SI-4 (16) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (16) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (16) NIST: NIST SP 800-53A (v1): SI-4 (16).1
CCI-004981 (policy, technical): Correlate information from monitoring mechanisms employed throughout the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (16)
CCI-001284 (policy): Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
References: NIST: NIST SP 800-53 (v3): SI-4 (17) NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (17) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (17) NIST: NIST SP 800-53A (v1): SI-4 (17).1
CCI-002670 (policy): Defines the interior points within the system where outbound communications will be analyzed to detect covert exfiltration of information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (18) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (18)
CCI-002671 (policy): Analyze outbound communications traffic at the external interfaces of the system to detect covert exfiltration of information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (18) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (18)
CCI-002672 (policy): Analyze outbound communications traffic at organization-defined interior points within the system to detect covert exfiltration of information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (18) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (18)
CCI-002673 (policy): Defines the additional monitoring to be implemented for individuals identified as posing an increased level of risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (19) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (19)
CCI-002674 (policy): Defines the sources that may be used to identify individuals who pose an increased level of risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (19) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (19)
CCI-002675 (policy): Implement organization-defined additional monitoring of individuals who have been identified by organization-defined sources as posing an increased level of risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (19) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (19)
CCI-002676 (policy): Defines additional monitoring to be implemented for privileged users.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (20) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (20)
CCI-002677 (policy): Implement organization-defined additional monitoring of privileged users.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (20) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (20)
CCI-002678 (policy): Defines additional monitoring to be implemented for individuals during an organization-defined probationary period.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (21) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (21)
CCI-002679 (policy): Defines the probationary period during which additional monitoring will be implemented for individuals.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (21) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (21)
CCI-002680 (policy): Implement organization-defined additional monitoring of individuals during an organization-defined probationary period.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (21) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (21)
CCI-002681 (policy): Defines the authorization or approval process for network services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (a)
CCI-002682 (policy): Defines the personnel or roles to be alerted when unauthorized or unapproved network services are detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (a)
CCI-002683 (policy, technical): Detect network services that have not been authorized or approved by the organization-defined authorization or approval processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (a)
CCI-002684 (technical): Audit and/or alert organization-defined personnel when unauthorized network services are detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (b)
CCI-002685 (policy): Defines the host-based monitoring mechanisms to be implemented at organization-defined information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (23) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (23)
CCI-002686 (policy): Defines the system components at which organization-defined host-based monitoring mechanisms are to be implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (23) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (23)
CCI-002687 (policy): Implement organization-defined host-based monitoring mechanisms at organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (23) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (23)
CCI-002688 (technical): Discover indicators of compromise.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (24)
CCI-002689 (technical): Collects indicators of compromise.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (24)
CCI-002690 (technical): Distribute indicators of compromise provided by organization-defined sources, to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24) NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (24)