Logging, Monitoring, and Incident Response

Updates for this SFS are pending because supporting source research is incomplete. Existing catalog content is shown.

This set covers event sources, central log collection, record integrity, time consistency, monitoring coverage, alert handling, and incident escalation. It includes endpoint protection and deception mechanisms such as honeypots where they are part of the declared system. Questions should specify which events and services are monitored and what evidence demonstrates detection or response during the review period. Recovery after disruption belongs to SFS 2, while organizational authority and policy ownership belong to SFS D.

• SF 0
• SF 1
• SF 2
• SF 3
• SF 4
• SF 5
• SF 6
• SF 7
• SF 8
• SF 9
• SF A
• SF B
• SF C
• SF D
• SF E
• SF F