[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-4":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-4","SI-4","System Monitoring",508,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must monitor its systems to detect attacks, indicators of attack and unauthorised connections or use, deploy monitoring at strategic points, analyse detected events and protect monitoring information.\n\n**In practice.** This means collecting telemetry from endpoints, identity platforms, network and cloud services into a central platform, with detection rules mapped to known attacker techniques and a team that triages alerts around the clock or through a managed service. Auditors expect a description of monitoring coverage, use case documentation, alert handling records and metrics such as time to triage. CIS Control 13 covers the same ground.\n\n**Common gaps.** Typical gaps are blind spots in cloud and SaaS logging, detection rules that were never tuned or tested, and alert volumes the team cannot handle. Monitoring coverage is rarely compared with the asset inventory.","a. Monitor the system to detect:\n    1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives] ; and\n    2. Unauthorized local, network, and remote connections;\n  b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];\n  c. Invoke internal monitoring capabilities or deploy monitoring devices:\n    1. Strategically within the system to collect organization-determined essential information; and\n    2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;\n  d. Analyze detected events and anomalies;\n  e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;\n  f. Obtain legal opinion regarding system monitoring activities; and\n  g. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection: as needed; {{ insert: param, si-04_odp.06 }} ].\nDiscussion: System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software.\n\nDepending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls [SC-7](#sc-7) and [AC-17](#ac-17) . The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-17(1)](#ac-17.1), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) ). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":25,"title":26,"published_at":27},"burger-king-japan-breach-exposes-11m-app-users-personal-data","Burger King Japan Breach Exposes 11M App Users' Personal Data","2026-10-16T15:20:48.695+00:00",{"slug":29,"title":30,"published_at":31},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":33,"title":34,"published_at":35},"peerstitch-malware-exploits-unpatched-fortios-to-evade-detection-via-legitimate-processes","PEERSTITCH Malware Exploits Unpatched FortiOS to Evade Detection via Legitimate Processes","2026-10-16T08:21:33.492+00:00",{"slug":37,"title":38,"published_at":39},"silent-lynx-exploits-unpatched-winrar-flaw-to-backdoor-cis-governments","Silent Lynx Exploits Unpatched WinRAR Flaw to Backdoor CIS Governments","2026-10-15T18:20:53.262+00:00",{"slug":41,"title":42,"published_at":43},"help-tds-hotejka-exploit-20000-cloudflare-pages-domains-for-tech-support-scams","Help TDS & Hotejka Exploit 20,000+ Cloudflare Pages Domains for Tech Support Scams","2026-10-15T16:20:52.987+00:00",{"slug":45,"title":46,"published_at":47},"centerpoint-energy-breach-exposes-1m-texans-pii-via-cybercrime-forum-disclosure","CenterPoint Energy Breach Exposes 1M+ Texans' PII via Cybercrime Forum Disclosure","2026-10-15T10:20:22.506+00:00",{"slug":49,"title":50,"published_at":51},"zero-trust-is-more-than-a-buzzword-identity-first-always","Zero Trust Is More Than a Buzzword — Identity First, Always","2026-10-14T18:22:29.051+00:00",{"slug":53,"title":54,"published_at":55},"ai-coding-agents-require-dedicated-endpoint-visibility-and-forensic-controls","AI Coding Agents Require Dedicated Endpoint Visibility and Forensic Controls","2026-10-12T12:21:09.449+00:00",{"slug":57,"title":58,"published_at":59},"15000-mule-money-laundering-network-highlights-human-exploitation-risks","15,000-Mule Money Laundering Network Highlights Human Exploitation Risks","2026-10-12T12:20:52.359+00:00",{"slug":61,"title":62,"published_at":63},"ai-powered-penetration-tools-weaponized-against-south-korean-banks","AI-Powered Penetration Tools Weaponized Against South Korean Banks","2026-10-10T16:20:36.028+00:00",{"slug":65,"title":66,"published_at":67},"ahsaycbs-vulnerabilities-exploited-to-deploy-disguised-crypto-miners","AhsayCBS Vulnerabilities Exploited to Deploy Disguised Crypto Miners","2026-10-09T16:21:54.955+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",217,{"slug":75,"name":76,"problem":77,"stories":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",156,{"slug":80,"name":81,"problem":82,"stories":83},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",83,{"slug":85,"name":86,"problem":87,"stories":88},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",73,{"slug":90,"name":91,"problem":92,"stories":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",63,{"slug":95,"name":96,"problem":97,"stories":98},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",61,[100,106,111,116,121,127,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","6","Control 6","Access Control Management",240,{"family":5,"item":107,"code":108,"title":109,"together":110},"ac-2","AC-2","Account Management",225,{"family":101,"item":112,"code":113,"title":114,"together":115},"13","Control 13","Network Monitoring and Defense",209,{"family":101,"item":117,"code":118,"title":119,"together":120},"8","Control 8","Audit Log Management",189,{"family":122,"item":123,"code":124,"title":125,"together":126},"gdpr","32","Article 32","Security of processing",187,{"family":101,"item":128,"code":129,"title":130,"together":131},"12","Control 12","Network Infrastructure Management",132,{"family":133,"item":134,"code":135,"title":135,"together":136},"itil","overview","ITIL",121,{"family":101,"item":138,"code":139,"title":140,"together":141},"3","Control 3","Data Protection",109]