Automated Intrusion Recognition and Responses
LOW MODERATE HIGHRequirements NIST SOURCE
Recognize [classes or types of intrusions] and initiate [response actions] using [automated mechanisms].
Discussion (NIST Supplemental Guidance)
Response actions can include notifying selected organizational personnel or law enforcement personnel. Automated mechanisms implemented to initiate response actions include system alert notifications, email and text messages, and activating door locking mechanisms. Physical access monitoring can be coordinated with intrusion detection systems and system monitoring capabilities to provide integrated threat coverage for the organization.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PE-6(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- classes or types of intrusions to be recognized by automated mechanisms are defined;
- response actions to be initiated by automated mechanisms when organization-defined classes or types of intrusions are recognized are defined;
- automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined;
- <PE-06(02)_ODP[01] classes or types of intrusions> are recognized;
- <PE-06(02)_ODP[02] response actions> are initiated using <PE-06(02)_ODP[03] automated mechanisms>.
Examine
[SELECT FROM: Physical and environmental protection policy; procedures addressing physical access monitoring; system design documentation; system configuration settings and associated documentation; system audit records; list of response actions to be initiated when specific classes/types of intrusions are recognized; system security plan; privacy plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with physical access monitoring responsibilities; organizational personnel with information security and privacy responsibilities].
Test
[SELECT FROM: Organizational processes for monitoring physical access; automated mechanisms supporting and/or implementing physical access monitoring; automated mechanisms supporting and/or implementing recognition of classes/types of intrusions and initiation of a response].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PE-6(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Physical and environmental protection policy
- system security plan
- privacy plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Organizational processes for monitoring physical access
- automated mechanisms supporting and/or implementing physical access monitoring
- automated mechanisms supporting and/or implementing recognition of classes/types of intrusions and initiation of a response
Other Records
- procedures addressing physical access monitoring
- system audit records
- list of response actions to be initiated when specific classes/types of intrusions are recognized
- other relevant documents or records