← SI-4
SI-4(5) SI · System and Information Integrity

System-generated Alerts

LOW ✓ MODERATE ✓ HIGH
1 Overlay 3 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Alert [personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [compromise indicators].

Discussion (NIST Supplemental Guidance)

Alerts may be generated from a variety of sources, including audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be automated and may be transmitted telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the alert notification list can include system administrators, mission or business owners, system owners, information owners/stewards, senior agency information security officers, senior agency officials for privacy, system security officers, or privacy officers. In contrast to alerts generated by the system, alerts generated by organizations in SI-4(12) focus on information sources external to the system, such as suspicious activity reports and reports on potential insider threats.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for SI-4(5) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. personnel or roles to be alerted when indications of compromise or potential compromise occur is/are defined;
  2. compromise indicators are defined;
  3. <SI-04(05)_ODP[01] personnel or roles> are alerted when system-generated <SI-04(05)_ODP[02] compromise indicators> occur.

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring tools and techniques; system monitoring tools and techniques documentation; system configuration settings and associated documentation; list of personnel selected to receive alerts; documentation of alerts generated based on compromise indicators; system audit records; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; system developers; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for monitoring the system; organizational personnel on the system alert notification list; organizational personnel responsible for the intrusion detection system].

Test

[SELECT FROM: Organizational processes for intrusion detection and system monitoring; mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities; mechanisms supporting and/or implementing alerts for compromise indicators].

Overlays

Showing the OT/ICS overlay for the parent control SI-4 — see the SI-4(5) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

  • Base control: Included (matches standard baseline)

MODERATE

  • Base control: Included (matches standard baseline)
  • Included: (2) (4) (5)

HIGH

  • Base control: Included (matches standard baseline)
  • Included: (2) (4) (5) (10) (12) (14) (20) (22)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for SI-4(5). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • System and information integrity policy
  • system security plan
  • privacy plan

Configuration

  • system configuration settings and associated documentation

Testing

  • Organizational processes for intrusion detection and system monitoring
  • mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
  • mechanisms supporting and/or implementing alerts for compromise indicators

Other Records

  • system and information integrity procedures
  • procedures addressing system monitoring tools and techniques
  • system monitoring tools and techniques documentation
  • list of personnel selected to receive alerts
  • documentation of alerts generated based on compromise indicators
  • system audit records
  • other relevant documents or records