Requirement
The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
Points of Focus
Implements Detection Policies, Procedures, and Tools
Requirement: Detection policies, procedures, and tools are defined and implemented on infrastructure and software to identify potential intrusions, inappropriate access, and anomalies in the operation of or unusual activity on systems. Procedures may include (1) a defined governance process for security event detection and management; (2) use of intelligence sources to identify newly discovered threats and vulnerabilities; and (3) logging of unusual system activities.
Designs Detection Measures
Requirement: Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers; (2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software.
Implements Filters to Analyze Anomalies
Requirement: Management has implemented procedures to filter, summarize, and analyze anomalies to identify security events.
Monitors Detection Tools for Effective Operation
Requirement: Management has implemented processes to monitor and maintain the effectiveness of detection tools.
Explanation
The organization must watch its systems continuously for unusual activity — intrusions, inappropriate access, or operational anomalies — and analyze what it finds to decide whether a security event has occurred. Auditors expect deployed detection tools, defined procedures for triaging alerts, and processes that keep the monitoring itself working effectively.
