SI-4(7): Automated Response To Suspicious Events

Threats Addressed:


(Not part of any baseline)

Next Version:

Control Statement

The information system notifies [Assignment: organization-defined incident response personnel (identified by name and/or by role)] of detected suspicious events and takes [Assignment: organization-defined least-disruptive actions to terminate suspicious events].

Supplemental Guidance

Least-disruptive actions may include, for example, initiating requests for human responses.