{"data":{"id":"SI-04","name":"System Monitoring","family":"SI","family_name":"System and Information Integrity","withdrawn":false,"description":"a. Monitor the system to detect:\n1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and\n2. Unauthorized local, network, and remote connections;\nb. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];\nc. Invoke internal monitoring capabilities or deploy monitoring devices:\n1. Strategically within the system to collect organization-determined essential information; and\n2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;\nd. Analyze detected events and anomalies;\ne. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;\nf. Obtain legal opinion regarding system monitoring activities; and\ng. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].","supplemental_guidance":"System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software.\n\nDepending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls SC-07 and AC-17. The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., AC-02g, AC-02(07), AC-02(12)(a), AC-17(01), AU-13, AU-13(01), AU-13(02), CM-03f, CM-06d, MA-03a, MA-04a, SC-05(03)(b), SC-07a, SC-07(24)(b), SC-18b, SC-43b). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","enhancements":[{"id":"SI-04(01)","name":"System-wide Intrusion Detection System","statement":"Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.","baselines":[]},{"id":"SI-04(02)","name":"Automated Tools and Mechanisms for Real-time Analysis","statement":"Employ automated tools and mechanisms to support near real-time analysis of events.","baselines":["moderate","high"]},{"id":"SI-04(03)","name":"Automated Tool and Mechanism Integration","statement":"Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.","baselines":[]},{"id":"SI-04(04)","name":"Inbound and Outbound Communications Traffic","statement":"a. Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;\nb. Monitor inbound and outbound communications traffic [Assignment: organization-defined frequency] for [Assignment: organization-defined unusual or unauthorized activities or conditions].","baselines":["moderate","high"]},{"id":"SI-04(05)","name":"System-generated Alerts","statement":"Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].","baselines":["moderate","high"]},{"id":"SI-04(06)","name":"Restrict Non-privileged Users","withdrawn":true,"incorporated_into":["AC-06(10)"]},{"id":"SI-04(07)","name":"Automated Response to Suspicious Events","statement":"a. Notify [Assignment: organization-defined incident response personnel (identified by name and/or by role)] of detected suspicious events; and\nb. Take the following actions upon detection: [Assignment: organization-defined least-disruptive actions to terminate suspicious events].","baselines":[]},{"id":"SI-04(08)","name":"Protection of Monitoring Information","withdrawn":true,"incorporated_into":["SI-04"]},{"id":"SI-04(09)","name":"Testing of Monitoring Tools and Mechanisms","statement":"Test intrusion-monitoring tools and mechanisms [Assignment: organization-defined frequency].","baselines":[]},{"id":"SI-04(10)","name":"Visibility of Encrypted Communications","statement":"Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].","baselines":["high"]},{"id":"SI-04(11)","name":"Analyze Communications Traffic Anomalies","statement":"Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: organization-defined interior points within the system] to discover anomalies.","baselines":[]},{"id":"SI-04(12)","name":"Automated Organization-generated Alerts","statement":"Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts].","baselines":["high"]},{"id":"SI-04(13)","name":"Analyze Traffic and Event Patterns","statement":"a. Analyze communications traffic and event patterns for the system;\nb. Develop profiles representing common traffic and event patterns; and\nc. Use the traffic and event profiles in tuning system-monitoring devices.","baselines":[]},{"id":"SI-04(14)","name":"Wireless Intrusion Detection","statement":"Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.","baselines":["high"]},{"id":"SI-04(15)","name":"Wireless to Wireline Communications","statement":"Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.","baselines":[]},{"id":"SI-04(16)","name":"Correlate Monitoring Information","statement":"Correlate information from monitoring tools and mechanisms employed throughout the system.","baselines":[]},{"id":"SI-04(17)","name":"Integrated Situational Awareness","statement":"Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.","baselines":[]},{"id":"SI-04(18)","name":"Analyze Traffic and Covert Exfiltration","statement":"Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points within the system].","baselines":[]},{"id":"SI-04(19)","name":"Risk for Individuals","statement":"Implement [Assignment: organization-defined additional monitoring] of individuals who have been identified by [Assignment: organization-defined sources] as posing an increased level of risk.","baselines":[]},{"id":"SI-04(20)","name":"Privileged Users","statement":"Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].","baselines":["high"]},{"id":"SI-04(21)","name":"Probationary Periods","statement":"Implement the following additional monitoring of individuals during [Assignment: organization-defined probationary period]: [Assignment: organization-defined additional monitoring].","baselines":[]},{"id":"SI-04(22)","name":"Unauthorized Network Services","statement":"a. Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes]; and\nb. [Selection (one or more): Audit; Alert [Assignment: organization-defined personnel or roles]] when detected.","baselines":["high"]},{"id":"SI-04(23)","name":"Host-based Devices","statement":"Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].","baselines":[]},{"id":"SI-04(24)","name":"Indicators of Compromise","statement":"Discover, collect, and distribute to [Assignment: organization-defined personnel or roles], indicators of compromise provided by [Assignment: organization-defined sources].","baselines":[]},{"id":"SI-04(25)","name":"Optimize Network Traffic Analysis","statement":"Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SI-04","name":"System Monitoring","description":"a. Monitor the system to detect:\n1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and\n2. Unauthorized local, network, and remote connections;\nb. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];\nc. Invoke internal monitoring capabilities or deploy monitoring devices:\n1. Strategically within the system to collect organization-determined essential information; and\n2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;\nd. Analyze detected events and anomalies;\ne. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;\nf. Obtain legal opinion regarding system monitoring activities; and\ng. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].","discussion":"System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software.\n\nDepending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls SC-07 and AC-17. The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., AC-02g, AC-02(07), AC-02(12)(a), AC-17(01), AU-13, AU-13(01), AU-13(02), CM-03f, CM-06d, MA-03a, MA-04a, SC-05(03)(b), SC-07a, SC-07(24)(b), SC-18b, SC-43b). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.","related_controls":["AC-02","AC-03","AC-04","AC-08","AC-17","AU-02","AU-06","AU-07","AU-09","AU-12","AU-13","AU-14","CA-07","CM-03","CM-06","CM-08","CM-11","IA-10","IR-04","MA-03","MA-04","PL-09","PM-12","RA-05","RA-10","SC-05","SC-07","SC-18","SC-26","SC-31","SC-35","SC-36","SC-37","SC-43","SI-03","SI-06","SI-07","SR-09","SR-10"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Information System Monitoring' Control text replaces 'Protect information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion' with 'Analyze detected events and anomalies' and replaces 'Heightens' with 'Adjust' Discussion expanded with references to other controls"}},"compliance_mappings":{"iso_27001_2022":["9.1","A.8.12","A.8.16"],"iso_27002_2022":["5.25","8.12","8.16"],"cobit_2019":["DSS01","DSS05","MEA01"],"pci_dss_v4":["10.4","10.7","11.2","11.5","11.6"],"nist_csf_2":["ID.IM-01","ID.IM-02","ID.IM-03","ID.RA-01","PR.DS-01","PR.DS-02","PR.DS-10","DE.AE-02","DE.AE-03","DE.AE-04","DE.AE-06","DE.CM-01","DE.CM-03","DE.CM-06","DE.CM-09","RS.AN-03"],"cis_controls_v8":["CIS 1.4","CIS 3.13","CIS 8.7","CIS 8.9","CIS 10","CIS 10.7","CIS 13","CIS 13.1","CIS 13.2","CIS 13.3","CIS 13.6","CIS 13.7","CIS 13.8","CIS 13.10","CIS 13.11"],"soc2_tsc":["CC6.6","CC6.6-POF2","CC7.2","CC7.2-POF1","CC7.3"],"finos_ccc":["CCC-C08"],"iso_42001_2023":["A.6.2.6"],"iec_62443":["3-3 SR 6.2"],"asd_e8":[],"nis2":[],"apra_cps_234":["Para 22-23"],"mas_trm":["11","12"],"pra_op_resilience":["SS2/21-7.1"],"bsi_grundschutz":["DER.1"],"anssi":["Hygiene.29","Hygiene.39","SecNumCloud.13.7"],"osfi_b13":["B-13.3.3"],"finma_circular":["IV.C(66)","IV.C(67)","IV.C(68)","IV.C(69)"],"gdpr":["Art.32(1)(b)","Art.32(1)(d)"],"dora":["Art.10(1)","Art.10(2)"],"bio2":["5.25","8.12","8.16"],"rbi_csf":["Annex1.4","Annex1.13","Annex1.16","Annex1.20"],"fisc":["FISC.O2","FISC.O4"],"lgpd_bcb":["BCB.Art.3","BCB.Art.6","BCB.Art.7","BCB.PIX","LGPD.Art.46"],"hkma_tme1":["TME1.5.2","TME1.7.3","TME1.7.5","TME1.10.1","TME1.11.3"],"mlps_2":["8.1.3.3","8.1.4.4","8.1.4.5","8.1.5.4","8.1.10.5","8.2","8.3","8.4","8.5"],"dnb_good_practice":["DNB.16.1","DNB.19.1"],"cra":["CRA.I.2d","CRA.I.2i","CRA.I.2l"],"swift_cscf":["SWIFT.2.9","SWIFT.6.1","SWIFT.6.4","SWIFT.6.5A"],"cbb_tm":["TM-8","TM-12","TM-13"],"cbuae":["CR-3","CR-7"],"nca_ecc":["2-4","2-5","2-12","5-1"],"qatar_nia":["IM","OS"],"sama_csf":["3.3","3.6"],"uae_ia":["T7","T11"],"bog_cisd":["CISD-VI","CISD-VII"],"bom_ctrm":["3.2","4.1","4.2","5.1"],"cbe_csf":["CD-1","CTO-6","CTO-7","CTO-8"],"cbn_csf":["Part2.2","Part3.3","Part3.5","Part4"],"popia":["s19"],"sa_js2":["JS2-7.2","JS2-7.3","JS2-7.6","JS2-8.4"],"bcbs_239":["Principle 10"],"bot_cyber":["Ch2.6","Ch3.1","Ch8.2"],"cpmi_pfmi":["CG.DE","PFMI.P17"],"eba_ict":["3.4.5","3.5(c)","3.8(c)"],"ecb_croe":["CROE.2.3.5","CROE.2.4"],"ffiec_is":["II.C.9","II.C.12","II.C.16","II.D","III.A","III.B","III.C"],"hipaa_sr":["§164.308(a)(1)(ii)(D)","§164.308(a)(5)(ii)(B)","§164.308(a)(5)(ii)(C)","§164.308(a)(6)(ii)"],"iosco_cyber":["DET-1","DET-2","DET-3","DET-4"],"nydfs_500":["500.2","500.6","500.14"],"sebi_cscrf":["DE.CM","DE.DP","PR.NS","RS.AN","SOC"],"cmmc_2":["AU","SI"],"nerc_cip":["CIP-004-7","CIP-005-7","CIP-007-6","CIP-008-6","CIP-010-4","CIP-015-1"],"nrc_73_54":["RG5.71-A-AU","RG5.71-A-SI"],"tsa_psd":["SD-2 Sec C"],"ieee_1686":[],"ferc_cip":["Order 881"],"doe_c2m2":["SITUATION"],"api_1164":["Sec 9"],"awia":["AWWA Sec 4","AWWA Sec 5"],"iaea_nss":["Sec 5.5"],"pci_pts":["I","J","L"],"fips_140":[],"cbest":["CBEST.5"],"tiber_eu":["TIBER.BT"],"pci_hsm":[],"common_criteria":["CC Part 2 — FAU"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.5"],"fda_21_cfr_11":[],"fda_cyber":["MON-3","PU-3","SA-5"],"hitrust_csf":["09.c","09.e","09.g","11.a","11.c"],"iso_27799":["12.2","16.2"],"lloyds_ms":["MS2.1","MS8.5","MS8.10","MS8.12"],"naic_ds":["4","4-audit","4-monitoring","4B","5"],"nhs_dspt":["NDG-9.3","NDG-9.5","NDG-9.9"],"pra_ss1_23":["P5.2","P5.3"],"solvency_ii":["EIOPA-ICT-4.9"],"owasp_masvs_v2":["MASVS-RESILIENCE-4"],"csa_ccm_v4":["IVS-09","LOG-03","LOG-05","LOG-13","UEM-11"],"csa_aicm":["AIS-12","I&S-09","LOG-03","LOG-05","LOG-13","LOG-14","MDS-05","TVM-11","TVM-13","UEM-11"],"ccss_v9":["1.02.8","2.04.2","2.04.3"],"mica":["Art.62(5)","Art.62(8)","Art.68(1)","Art.88(1)","Art.92(1)"],"basel_sco60":["SCO60.13","SCO60.51","SCO60.55","SCO60.64","SCO60.65","SCO60.72"],"bssc":["GSP-12","NOS-06","TIS-05"],"sec_custody_digital":["SEC-CD-11","SEC-CD-16"],"dpdpa":["Act.8(5)","Rules.6(1)(c)","Rules.Sch1.B.7"],"nist_ai_rmf_1":["MEASURE 2.4","MEASURE 2.6","MEASURE 2.13"],"eu_ai_act":["Art.14(4)","Art.15(5)","Art.26(5)","Art.55(1)(d)"]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: nist_csf_2 ID.IM-01, ID.IM-02, ID.RA-01, PR.DS-01, PR.DS-02, PR.DS-10 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-004-7, CIP-005-7, CIP-008-6, CIP-010-4 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"detective","used_by_patterns":["SP-001","SP-002","SP-011","SP-012","SP-015","SP-016","SP-017","SP-023","SP-025","SP-026","SP-027","SP-028","SP-029","SP-030","SP-031","SP-032","SP-035","SP-036","SP-037","SP-038","SP-043","SP-045","SP-046","SP-047","SP-048","SP-049"],"attack":{"techniques":373,"route":"/api/v1/controls/SI-04?fields=attack"}}}