DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed

Warning icon.

Subcategory is withdrawn in the next version of this framework and incorporated into: ID.AM-03: Representations of the organization’s authorized network communication and internal and external network data flows are maintained.

Description

[csf.tools Note: Subcategories do not have detailed descriptions.]

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

AC-4: Information Flow Enforcement

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].

CA-3: Information Exchange

Approve and manage the exchange of information between the system and other systems using [Assignment (one or more): interconnection security agreements, information exchange security agreements, memoranda of understanding or agreement, service level agreements, user agreements, non-disclosure agreements, [Assignment: organization-defined type of agreement] ]; Document, as part of each exchange agreement, the interface characteristics, security and…

CM-2: Baseline Configuration

Develop, document, and maintain under configuration control, a current baseline configuration of the system; and Review and update the baseline configuration of the system: [Assignment: organization-defined frequency]; When required due to [Assignment: organization-defined circumstances] ; and When system components are installed or upgraded.

SI-4: System Monitoring

Monitor the system to detect: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives] ; and Unauthorized local, network, and remote connections; Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods]; Invoke internal monitoring capabilities or deploy monitoring devices:…

NIST SP 800-171 Revision 3.0

03.04.01: Baseline Configuration

Develop and maintain under configuration control, a current baseline configuration of the system. Review and update the baseline configuration of the system [Assignment: organization-defined frequency] and when system components are installed or modified.

03.04.12: System and Component Configuration for High-Risk Areas

Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: organization-defined system configurations]. Apply the following security requirements to the systems or components when the individuals return from travel: [Assignment: organization-defined security requirements].

03.12.05: Information Exchange

Approve and manage the exchange of CUI between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service-level agreements; user agreements; non-disclosure agreements; other types of agreements]. Document interface characteristics, security requirements, and responsibilities for each system as part of the exchange…

03.14.06: System Monitoring

Monitor the system to detect: Attacks and indicators of potential attacks and Unauthorized connections. Identify unauthorized use of the system. Monitor inbound and outbound communications traffic to detect unusual or unauthorized activities or conditions.

Cloud Controls Matrix v4.0

DSP-05: Data Flow Documentation

Create data flow documentation to identify what data is processed, stored or transmitted where. Review data flow documentation at defined intervals, at least annually, and after any change.

IPY-01: Interoperability and Portability Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for interoperability and portability including requirements for: Communications between application interfaces Information processing interoperability Application development portability Information/Data exchange, usage, portability, integrity, and persistence Review and update the policies and procedures at least annually.

IVS-09: Network Defense

Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.

LOG-03: Security Monitoring and Alerting

Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.

LOG-05: Audit Logs Monitoring and Response

Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.

SEF-06: Event Triage Processes

Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.

Critical Security Controls Version 8.1

3: Data Protection

Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.

3.8: Document Data Flows

Document data flows. Data flow documentation includes service provider data flows and should be based on the enterprise's data management process. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

NIST Special Publication 800-53 Revision 4

AC-4: Information Flow Enforcement

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].

CA-3: System Interconnections

The organization: Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements; Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and Reviews and updates Interconnection Security Agreements [Assignment: organization-defined frequency].

CM-2: Baseline Configuration

The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

SI-4: Information System Monitoring

The organization: Monitors the information system to detect: Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and Unauthorized local, network, and remote connections; Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods]; Deploys monitoring devices: Strategically within the information system to collect organization-determined essential information; and…

Cloud Controls Matrix v3.0.1

DSI-02: Data Inventory / Flows

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service’s geographically distributed (physical and virtual) applications and infrastructure network and systems components and/or shared with other third parties to ascertain any regulatory, statutory,…

Critical Security Controls Version 7.1

11.2: Document Traffic Configuration Rules

All configuration rules that allow traffic to flow through network devices should be documented in a configuration management system with a specific business reason for each rule, a specific individual's name responsible for that business need, and an expected duration of the need.

15: Wireless Access Control

The processes and tools used to track/control/prevent/correct the security use of wireless local area networks (WLANs), access points, and wireless client systems.