compliance controls are associated with this Policy definition 'Alert personnel of information spillage' (9622aaa9-5c49-40e2-5bf8-660b7cd23deb)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CIS_Azure_1.1.0 |
4.6 |
CIS_Azure_1.1.0_4.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.6 |
4 Database Services |
Ensure that 'Send alerts to' is set |
Shared |
The customer is responsible for implementing this recommendation. |
Provide the email address where alerts will be sent when anomalous activities are detected on SQL servers. |
link |
3 |
| CIS_Azure_1.1.0 |
4.7 |
CIS_Azure_1.1.0_4.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.7 |
4 Database Services |
Ensure that 'Email service and co-administrators' is 'Enabled' |
Shared |
The customer is responsible for implementing this recommendation. |
Enable service and co-administrators to receive security alerts from the SQL server. |
link |
3 |
| CIS_Azure_1.1.0 |
5.2.1 |
CIS_Azure_1.1.0_5.2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.1 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create Policy Assignment |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create Policy Assignment event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.2 |
CIS_Azure_1.1.0_5.2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.2 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Network Security Group |
Shared |
The customer is responsible for implementing this recommendation. |
Create an Activity Log Alert for the "Create" or "Update Network Security Group" event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.3 |
CIS_Azure_1.1.0_5.2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.3 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Network Security Group |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Network Security Group event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.4 |
CIS_Azure_1.1.0_5.2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.4 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update Network Security Group Rule event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.5 |
CIS_Azure_1.1.0_5.2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.5 |
5 Logging and Monitoring |
Ensure that activity log alert exists for the Delete Network Security Group Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Network Security Group Rule event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.6 |
CIS_Azure_1.1.0_5.2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.6 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Security Solution |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update Security Solution event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.7 |
CIS_Azure_1.1.0_5.2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.7 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Security Solution |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Security Solution event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.8 |
CIS_Azure_1.1.0_5.2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.8 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update or Delete SQL Server Firewall Rule event. |
link |
4 |
| CIS_Azure_1.1.0 |
5.2.9 |
CIS_Azure_1.1.0_5.2.9 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.9 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Update Security Policy |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Update Security Policy event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.1 |
CIS_Azure_1.3.0_5.2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.1 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create Policy Assignment |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create Policy Assignment event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.2 |
CIS_Azure_1.3.0_5.2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.2 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Policy Assignment |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Policy Assignment event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.3 |
CIS_Azure_1.3.0_5.2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.3 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Network Security Group |
Shared |
The customer is responsible for implementing this recommendation. |
Create an Activity Log Alert for the "Create" or "Update Network Security Group" event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.4 |
CIS_Azure_1.3.0_5.2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.4 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Network Security Group |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Network Security Group event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.5 |
CIS_Azure_1.3.0_5.2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.5 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update Network Security Group Rule event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.6 |
CIS_Azure_1.3.0_5.2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.6 |
5 Logging and Monitoring |
Ensure that activity log alert exists for the Delete Network Security Group Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Network Security Group Rule event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.7 |
CIS_Azure_1.3.0_5.2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.7 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Security Solution |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update Security Solution event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.8 |
CIS_Azure_1.3.0_5.2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.8 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Security Solution |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Security Solution event. |
link |
4 |
| CIS_Azure_1.3.0 |
5.2.9 |
CIS_Azure_1.3.0_5.2.9 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.9 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update or Delete SQL Server Firewall Rule event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.1 |
CIS_Azure_1.4.0_5.2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.1 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create Policy Assignment |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create Policy Assignment event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.2 |
CIS_Azure_1.4.0_5.2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.2 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Policy Assignment |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Policy Assignment event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.3 |
CIS_Azure_1.4.0_5.2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.3 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Network Security Group |
Shared |
The customer is responsible for implementing this recommendation. |
Create an Activity Log Alert for the "Create" or "Update Network Security Group" event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.4 |
CIS_Azure_1.4.0_5.2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.4 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Network Security Group |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Network Security Group event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.5 |
CIS_Azure_1.4.0_5.2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.5 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Network Security Group |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update Network Security Group Rule event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.6 |
CIS_Azure_1.4.0_5.2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.6 |
5 Logging and Monitoring |
Ensure that activity log alert exists for the Delete Network Security Group Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Network Security Group Rule event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.7 |
CIS_Azure_1.4.0_5.2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.7 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update Security Solution |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update Security Solution event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.8 |
CIS_Azure_1.4.0_5.2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.8 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Delete Security Solution |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Delete Security Solution event. |
link |
4 |
| CIS_Azure_1.4.0 |
5.2.9 |
CIS_Azure_1.4.0_5.2.9 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.9 |
5 Logging and Monitoring |
Ensure that Activity Log Alert exists for Create or Update or Delete SQL Server Firewall Rule |
Shared |
The customer is responsible for implementing this recommendation. |
Create an activity log alert for the Create or Update or Delete SQL Server Firewall Rule event. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.1 |
CIS_Azure_2.0.0_5.2.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.1 |
5.2 |
Ensure that Activity Log Alert exists for Create Policy Assignment |
Shared |
n/a |
Create an activity log alert for the Create Policy Assignment event.
Monitoring for create policy assignment events gives insight into changes done in "Azure policy - assignments" and can reduce the time it takes to detect unsolicited changes. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.2 |
CIS_Azure_2.0.0_5.2.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.2 |
5.2 |
Ensure that Activity Log Alert exists for Delete Policy Assignment |
Shared |
n/a |
Create an activity log alert for the Delete Policy Assignment event.
Monitoring for delete policy assignment events gives insight into changes done in "azure policy - assignments" and can reduce the time it takes to detect unsolicited changes. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.3 |
CIS_Azure_2.0.0_5.2.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.3 |
5.2 |
Ensure that Activity Log Alert exists for Create or Update Network Security Group |
Shared |
n/a |
Create an Activity Log Alert for the Create or Update Network Security Group event.
Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.4 |
CIS_Azure_2.0.0_5.2.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.4 |
5.2 |
Ensure that Activity Log Alert exists for Delete Network Security Group |
Shared |
n/a |
Create an activity log alert for the Delete Network Security Group event.
Monitoring for "Delete Network Security Group" events gives insight into network access changes and may reduce the time it takes to detect suspicious activity. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.5 |
CIS_Azure_2.0.0_5.2.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.5 |
5.2 |
Ensure that Activity Log Alert exists for Create or Update Security Solution |
Shared |
n/a |
Create an activity log alert for the Create or Update Security Solution event.
Monitoring for Create or Update Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.6 |
CIS_Azure_2.0.0_5.2.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.6 |
5.2 |
Ensure that Activity Log Alert exists for Delete Security Solution |
Shared |
n/a |
Create an activity log alert for the Delete Security Solution event.
Monitoring for Delete Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.7 |
CIS_Azure_2.0.0_5.2.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.7 |
5.2 |
Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule |
Shared |
There will be a substantial increase in log size if there are a large number of administrative actions on a server. |
Create an activity log alert for the Create or Update SQL Server Firewall Rule event.
Monitoring for Create or Update SQL Server Firewall Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity. |
link |
4 |
| CIS_Azure_2.0.0 |
5.2.8 |
CIS_Azure_2.0.0_5.2.8 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.2.8 |
5.2 |
Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule |
Shared |
There will be a substantial increase in log size if there are a large number of administrative actions on a server. |
Create an activity log alert for the "Delete SQL Server Firewall Rule."
Monitoring for Delete SQL Server Firewall Rule events gives insight into SQL network access changes and may reduce the time it takes to detect suspicious activity. |
link |
4 |
| FedRAMP_High_R4 |
IR-9 |
FedRAMP_High_R4_IR-9 |
FedRAMP High IR-9 |
Incident Response |
Information Spillage Response |
Shared |
n/a |
The organization responds to information spills by:
a. Identifying the specific information involved in the information system contamination;
b. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
c. Isolating the contaminated information system or system component;
d. Eradicating the information from the contaminated information system or component;
e. Identifying other information systems or system components that may have been subsequently contaminated; and
f. Performing other [Assignment: organization-defined actions].
Supplemental Guidance: Information spillage refers to instances where either classified or sensitive information is inadvertently placed on information systems that are not authorized to process such information. Such information spills often occur when information that is initially thought to be of lower sensitivity is transmitted to an information system and then is subsequently determined to be of higher sensitivity. At that point, corrective action is required. The nature of the organizational response is generally based upon the degree of sensitivity of the spilled information (e.g., security category or classification level), the security capabilities of the information system, the specific nature of contaminated storage media, and the access authorizations (e.g., security clearances) of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.
References: None. |
link |
7 |
| FedRAMP_High_R4 |
SI-4(5) |
FedRAMP_High_R4_SI-4(5) |
FedRAMP High SI-4 (5) |
System And Information Integrity |
System-Generated Alerts |
Shared |
n/a |
The information system alerts [Assignment: organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [Assignment: organization- defined compromise indicators].
Supplemental Guidance: Alerts may be generated from a variety of sources, including, for example, audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the notification list can include, for example, system administrators, mission/business owners, system owners, or information system security officers. Related controls: AU-5, PE-6. |
link |
3 |
| FedRAMP_Moderate_R4 |
IR-9 |
FedRAMP_Moderate_R4_IR-9 |
FedRAMP Moderate IR-9 |
Incident Response |
Information Spillage Response |
Shared |
n/a |
The organization responds to information spills by:
a. Identifying the specific information involved in the information system contamination;
b. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
c. Isolating the contaminated information system or system component;
d. Eradicating the information from the contaminated information system or component;
e. Identifying other information systems or system components that may have been subsequently contaminated; and
f. Performing other [Assignment: organization-defined actions].
Supplemental Guidance: Information spillage refers to instances where either classified or sensitive information is inadvertently placed on information systems that are not authorized to process such information. Such information spills often occur when information that is initially thought to be of lower sensitivity is transmitted to an information system and then is subsequently determined to be of higher sensitivity. At that point, corrective action is required. The nature of the organizational response is generally based upon the degree of sensitivity of the spilled information (e.g., security category or classification level), the security capabilities of the information system, the specific nature of contaminated storage media, and the access authorizations (e.g., security clearances) of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.
References: None. |
link |
7 |
| FedRAMP_Moderate_R4 |
SI-4(5) |
FedRAMP_Moderate_R4_SI-4(5) |
FedRAMP Moderate SI-4 (5) |
System And Information Integrity |
System-Generated Alerts |
Shared |
n/a |
The information system alerts [Assignment: organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [Assignment: organization- defined compromise indicators].
Supplemental Guidance: Alerts may be generated from a variety of sources, including, for example, audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the notification list can include, for example, system administrators, mission/business owners, system owners, or information system security officers. Related controls: AU-5, PE-6. |
link |
3 |
| hipaa |
0205.09j2Organizational.2-09.j |
hipaa-0205.09j2Organizational.2-09.j |
0205.09j2Organizational.2-09.j |
02 Endpoint Protection |
0205.09j2Organizational.2-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
Malicious code that is identified is blocked, quarantined, and an alert is sent to the administrators. |
|
10 |
| hipaa |
1216.09ab3System.12-09.ab |
hipaa-1216.09ab3System.12-09.ab |
1216.09ab3System.12-09.ab |
12 Audit Logging & Monitoring |
1216.09ab3System.12-09.ab 09.10 Monitoring |
Shared |
n/a |
Automated systems are used to review monitoring activities of security systems (e.g., IPS/IDS) and system records on a daily basis, and identify and document anomalies. |
|
20 |
| hipaa |
1217.09ab3System.3-09.ab |
hipaa-1217.09ab3System.3-09.ab |
1217.09ab3System.3-09.ab |
12 Audit Logging & Monitoring |
1217.09ab3System.3-09.ab 09.10 Monitoring |
Shared |
n/a |
Alerts are generated for technical personnel to analyze and investigate suspicious activity or suspected violations. |
|
5 |
| hipaa |
1218.09ab3System.47-09.ab |
hipaa-1218.09ab3System.47-09.ab |
1218.09ab3System.47-09.ab |
12 Audit Logging & Monitoring |
1218.09ab3System.47-09.ab 09.10 Monitoring |
Shared |
n/a |
Automated systems support near real-time analysis and alerting of events (e.g., malicious code, potential intrusions) and integrate intrusion detection into access and flow control mechanisms. |
|
7 |
| hipaa |
1222.09ab3System.8-09.ab |
hipaa-1222.09ab3System.8-09.ab |
1222.09ab3System.8-09.ab |
12 Audit Logging & Monitoring |
1222.09ab3System.8-09.ab 09.10 Monitoring |
Shared |
n/a |
The organization analyzes and correlates audit records across different repositories using a security information and event management (SIEM) tool or log analytics tools for log aggregation and consolidation from multiple systems/machines/devices, and correlates this information with input from non-technical sources to gain and enhance organization-wide situational awareness. Using the SIEM tool, the organization devise profiles of common events from given systems/machines/devices so that it can tune detection to focus on unusual activity, avoid false positives, more rapidly identify anomalies, and prevent overwhelming analysts with insignificant alerts. |
|
10 |
| hipaa |
1512.11a2Organizational.8-11.a |
hipaa-1512.11a2Organizational.8-11.a |
1512.11a2Organizational.8-11.a |
15 Incident Management |
1512.11a2Organizational.8-11.a 11.01 Reporting Information Security Incidents and Weaknesses |
Shared |
n/a |
Intrusion detection/information protection system (IDS/IPS) alerts are utilized for reporting information security events. |
|
17 |
| ISO27001-2013 |
A.12.4.1 |
ISO27001-2013_A.12.4.1 |
ISO 27001:2013 A.12.4.1 |
Operations Security |
Event Logging |
Shared |
n/a |
Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. |
link |
53 |
| NIST_SP_800-53_R4 |
IR-9 |
NIST_SP_800-53_R4_IR-9 |
NIST SP 800-53 Rev. 4 IR-9 |
Incident Response |
Information Spillage Response |
Shared |
n/a |
The organization responds to information spills by:
a. Identifying the specific information involved in the information system contamination;
b. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
c. Isolating the contaminated information system or system component;
d. Eradicating the information from the contaminated information system or component;
e. Identifying other information systems or system components that may have been subsequently contaminated; and
f. Performing other [Assignment: organization-defined actions].
Supplemental Guidance: Information spillage refers to instances where either classified or sensitive information is inadvertently placed on information systems that are not authorized to process such information. Such information spills often occur when information that is initially thought to be of lower sensitivity is transmitted to an information system and then is subsequently determined to be of higher sensitivity. At that point, corrective action is required. The nature of the organizational response is generally based upon the degree of sensitivity of the spilled information (e.g., security category or classification level), the security capabilities of the information system, the specific nature of contaminated storage media, and the access authorizations (e.g., security clearances) of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.
References: None. |
link |
7 |
| NIST_SP_800-53_R4 |
SI-4(5) |
NIST_SP_800-53_R4_SI-4(5) |
NIST SP 800-53 Rev. 4 SI-4 (5) |
System And Information Integrity |
System-Generated Alerts |
Shared |
n/a |
The information system alerts [Assignment: organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [Assignment: organization- defined compromise indicators].
Supplemental Guidance: Alerts may be generated from a variety of sources, including, for example, audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the notification list can include, for example, system administrators, mission/business owners, system owners, or information system security officers. Related controls: AU-5, PE-6. |
link |
3 |
| NIST_SP_800-53_R5 |
IR-9 |
NIST_SP_800-53_R5_IR-9 |
NIST SP 800-53 Rev. 5 IR-9 |
Incident Response |
Information Spillage Response |
Shared |
n/a |
Respond to information spills by:
a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills;
b. Identifying the specific information involved in the system contamination;
c. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
d. Isolating the contaminated system or system component;
e. Eradicating the information from the contaminated system or component;
f. Identifying other systems or system components that may have been subsequently contaminated; and
g. Performing the following additional actions: [Assignment: organization-defined actions]. |
link |
7 |
| NIST_SP_800-53_R5 |
SI-4(5) |
NIST_SP_800-53_R5_SI-4(5) |
NIST SP 800-53 Rev. 5 SI-4 (5) |
System and Information Integrity |
System-generated Alerts |
Shared |
n/a |
Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators]. |
link |
3 |
| PCI_DSS_v4.0 |
11.5.1 |
PCI_DSS_v4.0_11.5.1 |
PCI DSS v4.0 11.5.1 |
Requirement 11: Test Security of Systems and Networks Regularly |
Network intrusions and unexpected file changes are detected and responded to |
Shared |
n/a |
Intrusion-detection and/or intrusionprevention techniques are used to detect and/or prevent intrusions into the network as follows:
• All traffic is monitored at the perimeter of the CDE.
• All traffic is monitored at critical points in the CDE.
• Personnel are alerted to suspected compromises.
• All intrusion-detection and prevention engines, baselines, and signatures are kept up to date. |
link |
4 |
| PCI_DSS_v4.0 |
11.5.1.1 |
PCI_DSS_v4.0_11.5.1.1 |
PCI DSS v4.0 11.5.1.1 |
Requirement 11: Test Security of Systems and Networks Regularly |
Network intrusions and unexpected file changes are detected and responded to |
Shared |
n/a |
Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels. |
link |
3 |
| SWIFT_CSCF_v2022 |
6.5A |
SWIFT_CSCF_v2022_6.5A |
SWIFT CSCF v2022 6.5A |
6. Detect Anomalous Activity to Systems or Transaction Records |
Detect and contain anomalous network activity into and within the local or remote SWIFT environment. |
Shared |
n/a |
Intrusion detection is implemented to detect unauthorised network access and anomalous activity. |
link |
18 |