MA-4(1): Logging and Review
Control Family:
Parent Control:
CSF v1.1 References:
PF v1.0 References:
Threats Addressed:
Baselines:
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- MA-4(1): Auditing And Review
Control Statement
- Log [Assignment: organization-defined audit events] for nonlocal maintenance and diagnostic sessions; and
- Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.
Supplemental Guidance
Audit logging for nonlocal maintenance is enforced by AU-2 . Audit events are defined in AU-2a.
OT Baseline Rationale
Rationale for adding to Mod, High baselines: OT environments are often heavily dependent on nonlocal maintenance providers, so organizations should have the ability to review logs about relevant maintenance activities.