# SP-031 Security Monitoring and Response

Status: active. Release 26.02. Modified 2026-02-07. Licence: CC BY-SA 4.0.

Scope: End-to-end security operations pattern covering the full detection and response lifecycle: telemetry collection from endpoints, networks, and cloud; centralised correlation and analytics; orchestrated response and containment. Maps 48 NIST 800-53 controls across the collection, correlation, orchestration, and response pipeline.
Use when: This pattern applies to any organisation that needs to detect and respond to security threats -- which in practice means every organisation. It is particularly critical for organisations in regulated industries (financial services, healthcare, critical infrastructure) where detection and response capabilities are mandated.
Not when: Very small organisations (under 20 users) with simple IT environments may find a full SIEM/SOAR deployment disproportionate and should consider managed detection and response (MDR) services as an alternative.

## Controls (36, NIST SP 800-53 ids)
- Critical (10): AU-02, AU-03, AU-06, AU-08, AU-09, AU-12, CA-07, IR-04, IR-05, SI-04
- Important (18): AC-02, AC-04, AT-03, AU-04, AU-05, AU-07, CP-09, CP-10, IR-02, IR-06, IR-08, PM-14, PM-16, RA-03, RA-05, SC-07, SI-05, SI-07
- Standard (8): AC-07, AT-02, IA-05, IR-07, PL-02, PS-04, PS-07, SR-10

## What each critical control mitigates (10)
- AU-02 Event Logging: T-SMR-005, T-SMR-010, T-SMR-012
- AU-03 Content of Audit Records: none of the threats below
- AU-06 Audit Record Review, Analysis, and Reporting: T-SMR-001, T-SMR-003, T-SMR-006, T-SMR-009, T-SMR-011
- AU-08 Time Stamps: none of the threats below
- AU-09 Protection of Audit Information: T-SMR-007
- AU-12 Audit Record Generation: T-SMR-010
- CA-07 Continuous Monitoring: T-SMR-001, T-SMR-009, T-SMR-010
- IR-04 Incident Handling: T-SMR-002, T-SMR-011
- IR-05 Incident Monitoring: T-SMR-008
- SI-04 System Monitoring: T-SMR-001, T-SMR-002, T-SMR-003, T-SMR-004, T-SMR-005, T-SMR-006, T-SMR-009, T-SMR-010, T-SMR-011, T-SMR-012

## Threats and the controls that mitigate them (12)
- T-SMR-001 Advanced persistent threat with extended dwell time: AU-06, SI-04, CA-07, PM-16
- T-SMR-002 Ransomware deployment and encryption: SI-04, IR-04, CP-09, CP-10
- T-SMR-003 Insider threat and data theft: AU-06, AC-02, PS-04, SI-04
- T-SMR-004 Supply chain compromise via malicious update: SI-07, SR-10, RA-05, SI-04
- T-SMR-005 Credential compromise and account takeover: AU-02, AC-07, IA-05, SI-04
- T-SMR-006 Data exfiltration through authorised channels: SI-04, AU-06, AC-04, SC-07
- T-SMR-007 Log tampering and evidence destruction: AU-09, AU-05, SI-07, AU-04
- T-SMR-008 Alert fatigue causing missed critical detections: AU-07, IR-05, PM-14, AT-03
- T-SMR-009 Living-off-the-land attacks evading signature detection: AU-06, SI-04, CA-07, PM-16
- T-SMR-010 Cloud-native attacks bypassing on-premises monitoring: AU-02, AU-12, SI-04, CA-07
- T-SMR-011 Lateral movement within trusted network zones: SI-04, SC-07, AU-06, IR-04
- T-SMR-012 Detection evasion through encrypted channels: SI-04, SC-07, AU-02, RA-05

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-031/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-031/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 28 KB: /api/v1/patterns/SP-031
- Page for people: /patterns/sp-031/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-001 Client Module; SP-002 Server Module; SP-011 Cloud Computing Pattern; SP-025 Advanced Monitoring and Detection; SP-028 Secure DevOps Pipeline; SP-029 Zero Trust Architecture; SP-034 Cyber Resilience

This card, the API and the page are generated from one file. Checking one against another adds no evidence.