System Monitoring SI-4
System and Information Integrity · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SI-4 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Information Integrity family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SI-4 (System Monitoring) requires monitoring the system to detect attacks, unauthorized activity, and indicators of compromise — at the boundary and internally — and alerting the right people. At Moderate it includes intrusion detection and automated alerting.
What good looks like
- Monitor inbound and internal traffic and host activity for attacks and anomalies.
- Deploy intrusion-detection sensors at the boundary and on key hosts.
- Generate real-time alerts on detected events and route them to staff.
- Tune what is monitored to the threats that matter and retain the evidence.
Framework mapping
- NIST CSF 2.0 — DE.CM-01 — Networks and network services are monitored to find potentially adverse events
- CIS Controls v8 — Control 13 — Network Monitoring and Defense
How to move it toward Implemented
- SI-4 is met: Suricata and PlumbWatch actively monitor packets, the Secure Shell (SSH) auth log, and the Damn Vulnerable Web Application (DVWA) web log, raising real-time alerts — and the nmap negative control flipped the PACKETS panel to SCAN DETECTED.
- Capture evidence: the dated
plumbwatch --reportHTML plus a Suricatafast.logexcerpt showing the scan alert. - Attach that naming SI-4 to reach 'Completed'.
- Strengthening step: forward
fast.logandauth.logoff-host so detection and evidence survive a host compromise.