Security requirement
- a.Monitor the system to detect:
- 1.Attacks and indicators of potential attacks and
- 2.Unauthorized connections.
- b.Identify unauthorized use of the system.
- c.Monitor inbound and outbound communications traffic to detect unusual or unauthorized activities or conditions.
Discussion
System monitoring involves external and internal monitoring. Internal monitoring includes the observation of events that occur within the system. External monitoring includes the observation of events that occur at the system boundary. Organizations can monitor the system by observing audit record activities in real time or by observing other system aspects, such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. A system monitoring capability is achieved through a variety of tools and techniques (e.g., audit record monitoring software, intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms that support critical applications with such devices being employed at managed system interfaces. The granularity of monitoring the information collected is based on organizational monitoring objectives and the capability of the system to support such objectives. Systems connections can be network, remote, or local. A network connection is any connection with a device that communicates through a network (e.g., local area network, the internet). A remote connection is any connection with a device that communicates through an external network (e.g., the internet). Network, remote, and local connections can be either wired or wireless. Unusual or unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in the system or propagating among system components, the unauthorized export of information, or signaling to external systems. Evidence of malicious code is used to identify a potentially compromised system. System monitoring requirements, including the need for types of system monitoring, may be referenced in other requirements.
Implementation perspective
Treat System Monitoring as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to flaw remediation, malicious-code protection, monitoring, integrity, and trustworthy handling of CUI.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- patch and remediation records
- malware protection configuration
- monitoring alerts and response records
- integrity validation and exception reports
Common failure patterns
- patch compliance hiding unsupported assets
- alerts generated without response ownership
- exceptions that never expire
- integrity monitoring excluding critical configurations
Assessment objectives and methods
Assessment objectives (6)
- a.1.
the system is monitored to detect attacks.
- a.1.
the system is monitored to detect indicators of potential attacks.
- a.2.
the system is monitored to detect unauthorized connections.
- b.
unauthorized use of the system is identified.
- c.
inbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.
- c.
outbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.
Examine
- system and information integrity policy and procedures
- procedures for system monitoring tools and techniques
- continuous monitoring strategy
- facility diagram or layout
- system design documentation
- locations within the system where monitoring devices are deployed
- system configuration settings
- system protocols
- system audit records
- system security plan
- other relevant documents or records
Interview
- personnel with responsibilities for installing, configuring, or maintaining the system
- personnel with system monitoring responsibilities
- personnel with intrusion detection responsibilities
- personnel with information security responsibilities
- system administrators
Test
- processes for intrusion detection and system monitoring
- mechanisms for supporting or implementing system monitoring capabilities
- mechanisms for supporting or implementing intrusion detection and system monitoring capabilities
- mechanisms for supporting or implementing the monitoring of inbound and outbound communications traffic
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.