Monitor Communications for Attacks

frameworkCMMC Level 2 sectionSI System and Information Integrity csf 2.0DE.AE-02 DE.AE-03 DE.CM-01 DE.CM-06 DE.CM-09 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 PR.DS-01 PR.DS-02 PR.DS-10 topicsCont. Monitoring, Intrusion Detection frameworks7 4 0

Official textMonitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of SI.L2-3.14.6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.AE-02 DE.CM-01 DE.CM-03 DE.CM-09	Potentially adverse events are analyzed to better understand associated activities; Networks and network services are monitored to find potentially adverse events…	Crosswalk	Same topic: Intrusion Detection, Cont. Monitoring 6 loosely related (not mappings) DE.AE-03 Information is correlated from multiple sources Loosely related Only shares CSF DE.AE-03: related, not a mapping DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-06: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Loosely related Only shares CSF ID.RA-01: related, not a mapping PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Loosely related Only shares CSF PR.DS-01: related, not a mapping PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected Loosely related Only shares CSF PR.DS-02: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.8.16	Monitoring activities	Crosswalk	Same topic: Cont. Monitoring, Intrusion Detection 39 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 31 more in the downloads
CIS v8.1	CIS 13.1 CIS 13.2 CIS 13.3 CIS 13.6 CIS 13.7 CIS 13.8	Centralize Security Event Alerting; Deploy a Host-Based Intrusion Detection Solution…	Crosswalk	Same topic: Cont. Monitoring, Intrusion Detection 53 loosely related (not mappings) CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 7.1 Establish and Maintain a Vulnerability Management Process Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 8.11 Conduct Audit Log Reviews Loosely related Only shares CSF DE.AE-02: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 45 more in the downloads
SOC 2	CC7.2	Monitoring system components for anomalies	Editorial	Same topic: Cont. Monitoring, Intrusion Detection (editorial pick) 9 loosely related (not mappings) C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF DE.CM-01: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 1 more in the downloads
PCI DSS	10.4.1 11.5.1	Security event and critical logs reviewed daily; Intrusion detection or prevention on network traffic	Crosswalk	Same topic: Cont. Monitoring, Intrusion Detection 43 loosely related (not mappings) 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-06: related, not a mapping 11.3.1 Internal vulnerability scans every three months Loosely related Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping 11.3.2 External ASV scans every three months Loosely related Only shares CSF DE.CM-09, ID.IM-03, ID.RA-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF DE.AE-02, ID.RA-01: related, not a mapping 10.3.3 Logs promptly backed up to a central server Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping 10.3.4 File-integrity monitoring on logs Loosely related Only shares CSF DE.AE-02, DE.CM-09: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.IM-02, ID.RA-01: related, not a mapping …and 35 more in the downloads
800-53	CA-7 SI-4	Continuous Monitoring; System Monitoring	Crosswalk	Same topic: Cont. Monitoring, Intrusion Detection 57 loosely related (not mappings) IR-4 Incident Handling Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA-8 Penetration Testing Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR-8 Incident Response Plan Loosely related Only shares CSF DE.AE-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-5 Vulnerability Monitoring and Scanning Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SA-8 Security and Privacy Engineering Principles Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping SA-11 Developer Testing and Evaluation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping …and 49 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)	Information System Activity Review	Crosswalk	Same topic: Cont. Monitoring 38 loosely related (not mappings) §164.308(a)(8) Evaluation Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-06…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-01, DE.CM-06, DE.CM-09, ID.IM-01…: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-01, DE.CM-06, DE.CM-09, ID.IM-01…: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF DE.CM-09, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-01, DE.CM-06, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping …and 30 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)Art.32(1)(a)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +4 more loosely related (not mappings) Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF DE.CM-06: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF DE.CM-06: related, not a mapping Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping
NIS2	3.2	Monitoring and logging	Crosswalk	Same topic: Cont. Monitoring, Intrusion Detection 10 loosely related (not mappings) 4.3 Crisis management Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 2.1 Risk management framework Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.5 Security testing Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.7 Network security Loosely related Only shares CSF DE.CM-01: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 2 more in the downloads
Essential Eight	ISM-0109 ISM-1906 ISM-1907	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Editorial	Same topic: Cont. Monitoring (editorial pick) 41 loosely related (not mappings) ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-09: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-0843 Application control is implemented on workstations Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1490 Application control is implemented on internet-facing servers Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 33 more in the downloads
DORA	Art.9(1)Art.10(1)Art.10(2)Art.10(3)	Protection and prevention; Detection…	Editorial	Same topic: Cont. Monitoring, Intrusion Detection (editorial pick) 15 loosely related (not mappings) Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.8(2) Identification Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.25(1) Testing of ICT tools and systems Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.26(1) Advanced testing of ICT tools, systems and processes based on TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 7 more in the downloads
CPS 234	Para 23	Detect and respond to incidents in a timely manner	Editorial	Same topic: Intrusion Detection (editorial pick) 8 loosely related (not mappings) Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Para 16 Assess third parties' information security capability Loosely related Only shares CSF DE.CM-06: related, not a mapping Para 17 Keep capability current as threats and vulnerabilities change Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF DE.CM-06: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF DE.CM-06: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF DE.CM-06: related, not a mapping
Cyber Essentials	CE 3 CE 5	Security Update Management; Malware protection	Loosely related	No mapping. Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.