Security Monitoring
What is Security Monitoring?
The continuous observation and analysis of an organization's IT environment to detect security events, threats, and anomalies in real time.
Terms that appear alongside security monitoring
Each of these is named in at least one of the same controls as security monitoring. The number is how many controls name both.
- cloud security 8 shared controls
- incident response 7 shared controls
- nist 5 shared controls
- audit 5 shared controls
- integrity 5 shared controls
- threat intelligence 5 shared controls
- log management 5 shared controls
- soar 5 shared controls
Frameworks that govern security monitoring
What the standards actually require on security monitoring
Requirements naming security monitoring across 6 standards, quoted from the control text.
Deploy security monitoring across the ICS: intrusion detection and prevention systems suited to OT protocols, security audit logging, and security incident and event monitoring (SIEM) to detect and correlate adversarial activity.
CISA-ICS-DID-27 · Security Monitoring (IDS/IPS, Logging, SIEM) →Watch applications and their underlying infrastructure for security-relevant events, and alert responsible stakeholders when those events and their metrics cross defined thresholds.
CCM-LOG-03 · Security Monitoring and Alerting →Institutions shall continuously monitor and log security-relevant events to detect anomalous activities and potential information-security incidents, with appropriate alerting and response.
EBA-GL-3.4.5 · Security monitoring →Undertakings establish procedures to continuously monitor activities impacting information security (internal/external factors, provider and user transactions, internal/external threats) and implement capabilities to detect, report and respond to anomalous act...
EIOPA-ICTSG-GL.11 · Security monitoring →Centralized SIEM correlates logs across systems with use cases tuned to detect threats, with 24x7 monitoring.
IS-VI.A.2 · Security Monitoring and SIEM →HKMA TM-G-1 Cyber + Audit + Outsourcing + Cloud. (1) SECURITY MONITORING AND SIEM (TM-G-1.7.1) - SIEM + SOC + 24x7 monitoring + log management + correlation + use cases + alert handling + escalation + UEBA + behavior analytics + SOAR automation + threat detect...
HKMA-TMG1-Cyber-Monitoring-Threat-Intel-IR-Audit-Outsource-Cloud · TM-G-1 Security Monitoring + SIEM + Threat Intel + Cyber IR + Audit + Outsourcing + Cloud Computing Risk →Questions people ask about security monitoring
What is Security Monitoring?
Why is Security Monitoring important for compliance?
Which compliance frameworks address Security Monitoring?
Where can I learn more about Security Monitoring?
See how Security Monitoring applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.