Visibility of Encrypted Communications
LOW MODERATE ✓ HIGHRequirements NIST SOURCE
Make provisions so that [encrypted communications traffic] is visible to [system monitoring tools and mechanisms].
Discussion (NIST Supplemental Guidance)
Organizations balance the need to encrypt communications traffic to protect data confidentiality with the need to maintain visibility into such traffic from a monitoring perspective. Organizations determine whether the visibility requirement applies to internal encrypted traffic, encrypted traffic intended for external destinations, or a subset of the traffic types.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SI-4(10) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined;
- system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined;
- provisions are made so that <SI-04(10)_ODP[01] encrypted communications traffic> is visible to <SI-04(10)_ODP[02] system monitoring tools and mechanisms>.
Examine
[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring tools and techniques; system design documentation; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system protocols; system security plan; other relevant documents or records].
Interview
[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for monitoring the system; organizational personnel responsible for the intrusion detection system].
Test
[SELECT FROM: Organizational processes for intrusion detection and system monitoring; mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities; mechanisms supporting and/or implementing the visibility of encrypted communications traffic to monitoring tools].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SI-4(10). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and information integrity policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Organizational processes for intrusion detection and system monitoring
- mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
- mechanisms supporting and/or implementing the visibility of encrypted communications traffic to monitoring tools
Other Records
- system and information integrity procedures
- procedures addressing system monitoring tools and techniques
- system monitoring tools and techniques documentation
- system protocols
- other relevant documents or records