Automated Tools and Mechanisms for Real-time Analysis
LOW ✓ MODERATE ✓ HIGHRequirements NIST SOURCE
Employ automated tools and mechanisms to support near real-time analysis of events.
Discussion (NIST Supplemental Guidance)
Automated tools and mechanisms include host-based, network-based, transport-based, or storage-based event monitoring tools and mechanisms or security information and event management (SIEM) technologies that provide real-time analysis of alerts and notifications generated by organizational systems. Automated monitoring techniques can create unintended privacy risks because automated controls may connect to external or otherwise unrelated systems. The matching of records between these systems may create linkages with unintended consequences. Organizations assess and document these risks in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SI-4(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- automated tools and mechanisms are employed to support a near real-time analysis of events.
Examine
[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring tools and techniques; system design documentation; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system audit records; system security plan; privacy plan; privacy program plan; privacy impact assessment; privacy risk management documentation; other relevant documents or records].
Interview
[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for monitoring the system; organizational personnel responsible for incident response/management].
Test
[SELECT FROM: Organizational processes for the near real-time analysis of events; organizational processes for system monitoring; mechanisms supporting and/or implementing system monitoring; mechanisms/tools supporting and/or implementing an analysis of events].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SI-4(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and information integrity policy
- system security plan
- privacy plan
- privacy program plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Organizational processes for the near real-time analysis of events
- organizational processes for system monitoring
- mechanisms supporting and/or implementing system monitoring
- mechanisms/tools supporting and/or implementing an analysis of events
Other Records
- system and information integrity procedures
- procedures addressing system monitoring tools and techniques
- system monitoring tools and techniques documentation
- system audit records
- privacy impact assessment
- privacy risk management documentation
- other relevant documents or records