持续监控
监控网络和系统中的网络安全事件。
持续监控由以下 NIST CSF 2.0 成果定义：DE.CM-01 (Networks and network services are monitored to find potentially adverse events); DE.CM-03 (Personnel activity and technology usage are monitored to find potentially adverse events); DE.CM-09 (Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events)。 对照映射 通过 ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2, Essential Eight 和 DORA 中经编辑映射。 本站数据中无映射 本站数据中 GDPR, CPS 234 和 Cyber Essentials 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-01DE.CM-03DE.CM-09 | Networks and network services are monitored to find potentially adverse events; Personnel activity and technology usage are monitored to find potentially adverse events; Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | 主题定义 | DE.CM-01 DE.CM-03 DE.CM-09 |
| ISO 27001 | A.8.16 | Monitoring activities | 对照映射 | A.8.16: via DE.CM-01; DE.CM-03; DE.CM-09; NIST 800-53 map: SI-4 |
| CIS v8.1 | CIS 13.1CIS 13.6 | Centralize Security Event Alerting; Collect Network Traffic Flow Logs | 对照映射 | CIS 13.1: via DE.CM-01 CIS 13.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): network traffic flow logs for monitoring. |
| SOC 2 | CC7.2 | Monitoring system components for anomalies | 编辑说明 | CC7.2: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 10.4.1 | Security event and critical logs reviewed daily | 对照映射 | 10.4.1: via DE.CM-01; DE.CM-03 |
| CMMC | SI.L2-3.14.6SI.L2-3.14.7 | Monitor Communications for Attacks; Identify Unauthorized Use | 对照映射 | SI.L2-3.14.6: via 800-171r3 03.14.06 ↔ DE.CM-01, DE.CM-09 → SI-4; 800-171r2 Appendix D → SI-4 SI.L2-3.14.7: via 800-171r3 03.14.06 ↔ DE.CM-01, DE.CM-09 → SI-4; 800-171r2 Appendix D → SI-4 |
| 800-53 | CA-7SI-4 | Continuous Monitoring; System Monitoring | 对照映射 | CA-7: via DE.CM-01; DE.CM-03; DE.CM-09 SI-4: via DE.CM-01; DE.CM-09 |
| HIPAA | §164.308(a)(1)(ii)(D) | Information System Activity Review | 对照映射 | §164.308(a)(1)(ii)(D): via NIST HIPAA map: CA-7, SI-4 |
| GDPR | — | 无要求 | 本站数据中无映射 | 本站数据中没有 GDPR 要求映射到此主题。 |
| NIS2 | 3.2 | Monitoring and logging | 对照映射 | 3.2: via ENISA ISO map: A.8.16 |
| Essential Eight | ISM-1906ISM-1907ISM-0109 | Event logs from internet-facing servers are analysed in a timely manner to detect cyber…; Event logs from non-internet-facing servers are analysed in a timely manner to detect…; Event logs from workstations are analysed in a timely manner to detect cyber security… | 编辑说明 | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.9(1)Art.10(3) | Protection and prevention; Detection | 编辑说明 | Art.9(1): Continuously monitor and control the security and functioning of ICT systems and tools. Art.10(3): Resources and capabilities to monitor user activity, ICT anomalies and ICT-related incidents. |
| CPS 234 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CPS 234 要求映射到此主题。 |
| Cyber Essentials | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Cyber Essentials 要求映射到此主题。 |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于持续监控
持续监控通过收集和分析来自多个来源的安全遥测数据，实时或接近实时地掌握网络、系统和应用程序的安全状态。其范围包括网络流量分析、终端遥测、云工作负载监控以及文件完整性监控，用于发现未经授权的变更、策略违规和入侵指标。组织应根据自身威胁模型定义监控用例，为关键系统建立行为基线，并确保监控覆盖范围延伸至本地部署、云端和远程办公环境。