Control statement
Alert {{ insert: param, si-04.05_odp.01 }} when the following system-generated indications of compromise or potential compromise occur: {{ insert: param, si-04.05_odp.02 }}.
Guidance: In accordance with the incident response plan. Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is
preserved in the catalog database.
Covered by these Key Security Indicators
| KSI | Title | Category |
|---|---|---|
| KSI-INR-01 | Incident Response Procedures _Persistently_ review the effectiveness of documented incident response procedures. | Incident Response |
| KSI-MLA-07 | Event Types Maintain a list of information resources and event types that will be monitored, logged, and audited, then do so. | Monitoring, Logging, and Auditing |