|

controlSI-4

System Monitoring (SI-4)

Monitor the system to detect: Identify unauthorized use of the system through the following techniques and methods: [organization-defined]; Invoke internal monitoring capabilities or deploy monitoring devices: Analyze detected events and anomalies; Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; Obtain legal opinion regarding system monitoring activities; and Provide [organizat

Security Baselines

LOWMODERATEHIGH

integritymalwareflaw-remediationmonitoring

Why These Connect

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports99

These related controls work together — a change to one may affect the others.

Mitigates37

This control helps defend against or reduce the risk of the linked threat technique.

Enhances25

These enhancements add specific capabilities or refinements to the base control.

Related Controls(59)

AC-3Access Enforcement (AC-3)

AC-8System Use Notification (AC-8)

AC-17Remote Access (AC-17)

AC-18Wireless Access (AC-18)

AC-19Access Control for Mobile Devices (AC-19)

AU-2Event Logging (AU-2)

AU-4Audit Log Storage Capacity (AU-4)

AU-5Response to Audit Logging Process Failures (AU-5)

AU-6Audit Record Review, Analysis, and Reporting (AU-6)

AU-7Audit Record Reduction and Report Generation (AU-7)

AU-9Protection of Audit Information (AU-9)

AU-12Audit Record Generation (AU-12)

CA-7Continuous Monitoring (CA-7)

CM-3Configuration Change Control (CM-3)

CM-6Configuration Settings (CM-6)

CM-7Least Functionality (CM-7)

CM-11User-installed Software (CM-11)

CM-12Information Location (CM-12)

CP-9System Backup (CP-9)

IA-3Device Identification and Authentication (IA-3)

IR-4Incident Handling (IR-4)

IR-5Incident Monitoring (IR-5)

PE-3Physical Access Control (PE-3)

PM-12Insider Threat Program (PM-12)PM-14Testing, Training, and Monitoring (PM-14)PM-23Data Governance Body (PM-23)PM-31Continuous Monitoring Strategy (PM-31)RA-5Vulnerability Monitoring and Scanning (RA-5)

RA-10Threat Hunting (RA-10)SA-24Design For Cyber Resiliency (SA-24)SC-26Decoys (SC-26)SC-35External Malicious Code Identification (SC-35)SC-37Out-of-band Channels (SC-37)SC-48Sensor Relocation (SC-48)SI-3Malicious Code Protection (SI-3)

AC-2Account Management (AC-2)

AC-4Information Flow Enforcement (AC-4)

AU-13Monitoring for Information Disclosure (AU-13)AU-14Session Audit (AU-14)CM-8System Component Inventory (CM-8)

IA-10Adaptive Authentication (IA-10)MA-3Maintenance Tools (MA-3)

MA-4Nonlocal Maintenance (MA-4)

PL-9Central Management (PL-9)SC-5Denial-of-service Protection (SC-5)

SC-7Boundary Protection (SC-7)

SC-18Mobile Code (SC-18)

SC-31Covert Channel Analysis (SC-31)SC-36Distributed Processing and Storage (SC-36)SC-43Usage Restrictions (SC-43)SI-6Security and Privacy Function Verification (SI-6)

SI-7Software, Firmware, and Information Integrity (SI-7)

SR-9Tamper Resistance and Detection (SR-9)

SR-10Inspection of Systems or Components (SR-10)

SI-8Spam Protection (SI-8)

SI-15Information Output Filtering (SI-15)SI-18Personally Identifiable Information Quality Operations (SI-18)SR-2Supply Chain Risk Management Plan (SR-2)

SR-4Provenance (SR-4)

Threat Coverage(37 ATT&CK techniques)

T1566Phishing T1059Command and Scripting Interpreter T1204User Execution T1047Windows Management Instrumentation T1053Scheduled Task/Job T1505Server Software Component T1548Abuse Elevation Control Mechanism T1027Obfuscated Files or Information T1562Impair Defenses T1070Indicator Removal T1036Masquerading T1112Modify Registry T1110Brute Force T1003OS Credential Dumping T1528Steal Application Access Token T1558Steal or Forge Kerberos Tickets T1087Account Discovery T1046Network Service Discovery T1057Process Discovery T1018Remote System Discovery T1570Lateral Tool Transfer T1560Archive Collected Data T1005Data from Local System T1114Email Collection T1071Application Layer Protocol T1573Encrypted Channel T1105Ingress Tool Transfer T1041Exfiltration Over C2 Channel T1567Exfiltration Over Web Service T1048Exfiltration Over Alternative Protocol T1486Data Encrypted for Impact T1485Data Destruction T1499Endpoint Denial of Service T1498Network Denial of Service T1595Active Scanning T1598Phishing for Information T1588Obtain Capabilities

Control Enhancements(25)

SI-4(1)System-wide Intrusion Detection System (SI-4(1))

SI-4(2)Automated Tools and Mechanisms for Real-time Analysis (SI-4(2))

SI-4(3)Automated Tool and Mechanism Integration (SI-4(3))

SI-4(4)Inbound and Outbound Communications Traffic (SI-4(4))

SI-4(5)System-generated Alerts (SI-4(5))

SI-4(6)Restrict Non-privileged Users (SI-4(6))W

SI-4(7)Automated Response to Suspicious Events (SI-4(7))

SI-4(8)Protection of Monitoring Information (SI-4(8))W

SI-4(9)Testing of Monitoring Tools and Mechanisms (SI-4(9))

SI-4(10)Visibility of Encrypted Communications (SI-4(10))

SI-4(11)Analyze Communications Traffic Anomalies (SI-4(11))

SI-4(12)Automated Organization-generated Alerts (SI-4(12))

SI-4(13)Analyze Traffic and Event Patterns (SI-4(13))

SI-4(14)Wireless Intrusion Detection (SI-4(14))

SI-4(15)Wireless to Wireline Communications (SI-4(15))

SI-4(16)Correlate Monitoring Information (SI-4(16))

SI-4(17)Integrated Situational Awareness (SI-4(17))

SI-4(18)Analyze Traffic and Covert Exfiltration (SI-4(18))

SI-4(19)Risk for Individuals (SI-4(19))

SI-4(20)Privileged Users (SI-4(20))

SI-4(21)Probationary Periods (SI-4(21))

SI-4(22)Unauthorized Network Services (SI-4(22))

SI-4(23)Host-based Devices (SI-4(23))

SI-4(24)Indicators of Compromise (SI-4(24))

SI-4(25)Optimize Network Traffic Analysis (SI-4(25))

See Also

@SP 800-53 Overview ⚖Compare Baselines