# System Monitoring Standard

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/standards/system-monitoring-standard/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The system and information integrity policy says each system must be monitored for attacks and misuse; this standard says what is monitored, where the data goes, which detections run, how fast alerts are handled, how long the data is kept and what is reported. Keep the values here in step with the SI-4 statements in the policy, and with the AU-6 and AU-11 statements in the audit and accountability policy, since assessors compare them. Which events each component logs, and what each record contains, belong to the audit and accountability policy (AU-2, AU-3 and AU-12) and the [audit logging standard](https://kston83.github.io/nist-guide/templates/standards/audit-logging-standard/); the steps of the manual review in section 7 are in the [log review procedure](https://kston83.github.io/nist-guide/templates/procedures/log-review-procedure/). Most monitoring is a common control: the security operations team, the SIEM platform, endpoint detection and response, and network detection. Record in each system security plan which parts the system inherits and which it owns, such as sending its logs and its application-specific detections. [NIST SP 800-137](https://csrc.nist.gov/pubs/sp/800/137/final), Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations (September 2011, current as of September 2026), places system monitoring within an organization's continuous monitoring program.

| Owner | Approved by | Version | Effective date |
| --- | --- | --- | --- |
| [Chief Information Security Officer] | [Fill in: name and title] | [Fill in: version] | [Fill in: date] |

## 1. Purpose and scope

This standard sets the minimum requirements for monitoring the systems of [Organization name] to detect attacks, unauthorized connections and unauthorized use, and for handling what monitoring finds. It applies to every system in the system inventory and every component in each system's component inventory, including cloud services, identity services, endpoints, network and security devices, and systems that providers operate for the organization.

## 2. Roles

| Role | Responsibilities |
| --- | --- |
| [Chief Information Security Officer] | Owns this standard and the monitoring program; provides the monitoring platforms; obtains legal review of monitoring; decides when the level of monitoring changes |
| [Security operations team] | Runs the SIEM platform and detection tools; writes, tunes and tests detections; triages alerts around the clock or at the hours set below; refers suspected incidents; reports on monitoring |
| [System owner] | Makes sure every component sends its logs and runs the monitoring agents; tells the [Security operations team] about new components and changes; owns application-specific detections; acts on alerts about the system |
| [Incident response team] | Handles incidents that monitoring refers to it under the incident response plan |

## 3. Monitoring objectives and legal review

- Each system shall be monitored to detect attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Fill in: monitoring objectives to detect attacks and indicators of potential attacks on the system. Typical: detecting attacks, malware, unauthorized access, privilege misuse and data exfiltration]. (SI-4a.1)
- Each system shall be monitored to detect unauthorized local, network and remote connections. (SI-4a.2)
- The [Chief Information Security Officer] shall obtain a legal opinion on system monitoring activities before they begin and whenever they change significantly, including any decryption of traffic and any monitoring of individual users, and shall keep the opinion on record. (SI-4f)
- Systems shall display a system use notification that tells users their activity may be monitored. (AC-8)

## 4. Log sources and coverage

- Monitoring capabilities shall be deployed strategically within each system to collect the essential information the monitoring objectives call for, including at the managed interfaces in the boundary protection standard. (SI-4c.1)
- Each system shall send the log sources in the table below to [Fill in: for example the SIEM platform], or make them available to it, within [Fill in: for example 15 minutes] of the event. (SI-4c.1)
- Endpoint detection and response shall run on every server and workstation that supports it. (SI-4c.1)
- Monitoring capabilities shall be deployable at ad hoc locations within each system to track specific types of transactions of interest, such as during an investigation. (SI-4c.2)
- The [Security operations team] shall compare the log sources received with each system's component inventory [Fill in: for example monthly], and report components that send no logs, or have stopped, to the system owner. (SI-4c.1)
- Log sources shall use a common time source, so that events from different sources can be put in order. (AU-8)

| Log source | Examples | Required for |
| --- | --- | --- |
| Identity and access | [Fill in: for example the identity provider, directory services, single sign-on, multifactor authentication and privileged access management] | [Fill in: for example all systems] |
| Endpoints | [Fill in: for example endpoint detection and response, operating system security logs] | [Fill in: for example all servers and workstations] |
| Network and boundary | [Fill in: for example firewalls, proxies, DNS, VPN or zero trust access, intrusion detection and prevention, network flow records] | [Fill in: for example all managed interfaces] |
| Cloud control plane | [Fill in: for example cloud provider audit logs, configuration changes and threat detection findings] | [Fill in: for example all cloud accounts] |
| Applications and databases | [Fill in: for example authentication, authorization failures, administrative actions and access to sensitive records] | [Fill in: for example systems that process sensitive information] |
| Email and collaboration | [Fill in: for example email gateway, mailbox audit and file sharing logs] | [Fill in: for example the enterprise services] |
| Security tools | [Fill in: for example malicious code protection, data loss prevention and vulnerability scanning results] | [Fill in: for example all systems] |

## 5. Detection

- Unauthorized use of each system shall be identified through [Fill in: techniques and methods used to identify unauthorized use of the system. Typical: log correlation in the security information and event management (SIEM) platform, endpoint detection and response, network intrusion detection and user behavior analytics]. (SI-4b)
- The [Security operations team] shall employ automated tools and mechanisms, such as correlation rules in the SIEM platform and endpoint detection and response, to support near real-time analysis of events. (SI-4(2))
- The [Security operations team] shall determine and document criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic. (SI-4(4)(a))
- Inbound communications traffic shall be monitored [Fill in: the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions. Typical: continuously] for [Fill in: unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic. Typical: connections from known malicious sources, unapproved protocols and ports, and scanning or password-guessing patterns]. (SI-4(4)(b))
- Outbound communications traffic shall be monitored [Fill in: the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions. Typical: continuously] for [Fill in: unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic. Typical: connections to known malicious destinations, unusual data volumes, unapproved protocols and regular beaconing to external hosts]. (SI-4(4)(b))
- Each system shall alert [Fill in: personnel or roles to be alerted when indications of compromise or potential compromise occur. Typical: the security operations team] when the following system-generated indications of compromise or potential compromise occur: [Fill in: compromise indicators. Typical: indicators of compromise from the detection tools and threat intelligence feeds]. (SI-4(5))
- Each detection shall be recorded with what it detects, its data sources, its severity, its owner and the response it calls for, and mapped to the attack techniques it covers where the organization uses a catalog of techniques. (SI-4b)
- Detections shall be tested [Fill in: for example when written and at least annually], and tuned when they produce false positives, so that they still fire on the activity they are meant to catch. (SI-4b)
- Threat intelligence feeds that supply indicators of compromise and known malicious sources and destinations shall be kept current. (SI-4(5))

## 6. Alert handling

- The [Security operations team] shall triage alerts [Fill in: for example around the clock, directly or through a managed security service]. (SI-4d)
- The [Security operations team] shall analyze detected events and anomalies, and refer suspected incidents to the [Incident response team] under the incident response plan. (SI-4d)
- Each alert shall be closed only with a recorded outcome: false positive, benign, or referred as a suspected incident, with a short note of what was checked. (SI-4d)

| Alert severity | Triage begins within | Examples |
| --- | --- | --- |
| Critical | [Fill in: for example 15 minutes] | [Fill in: for example confirmed malware execution, a known indicator of compromise, a disabled security tool] |
| High | [Fill in: for example 1 hour] | [Fill in: for example suspicious privileged activity, traffic to a known malicious destination] |
| Medium | [Fill in: for example 8 hours] | [Fill in: for example repeated failed logons, an unapproved service] |
| Low | [Fill in: for example 3 business days] | [Fill in: for example policy violations with no sign of compromise] |

## 7. Audit record review and retention

- The [Security operations team] shall review and analyze system audit records [Fill in: frequency at which system audit records are reviewed and analyzed. Typical: continuously through automated alerting, with a documented manual review at least weekly] for indications of [Fill in: inappropriate or unusual activity. Typical: the activity listed in the log review procedure, such as repeated failed logons, privilege escalation and access outside normal patterns] and its potential impact, and report findings to [Fill in: personnel or roles to receive findings from reviews and analyses of system records. Typical: the system owner and the incident response team]. (AU-6a, AU-6b)
- Each manual review shall leave a dated record of what was reviewed, what was found and to whom it was reported. (AU-6a)
- Audit records and monitoring data shall be retained for [Fill in: a time period to retain audit records that is consistent with the records retention policy. Typical: at least one year, or longer where the records retention schedule or a law requires it], to support after-the-fact investigation of incidents and to meet regulatory and organizational retention requirements. (AU-11)
- Monitoring data shall be kept [Fill in: for example 6 months] in a form that can be searched at once, and the rest of the retention period in a form that can be restored for search when needed. (AU-11)

## 8. Changes in risk

- The [Chief Information Security Officer] shall adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations or the Nation, such as a relevant threat advisory, an incident, or a major change to the system. (SI-4e)
- The [Security operations team] shall adjust the level of audit record review, analysis and reporting when law enforcement information, intelligence information or other credible sources indicate a change in risk. (AU-6c)
- Each increase and its end shall be recorded with the reason and what changed. (SI-4e)

## 9. Additional monitoring for High systems

This section applies to High systems.

- Provisions shall be made so that [Fill in: encrypted communications traffic to be made visible to system monitoring tools and mechanisms. Typical: encrypted traffic crossing the internet connection and the public-facing subnetwork, except categories exempted after legal and privacy review, such as health and financial sites] is visible to [Fill in: system monitoring tools and mechanisms to be provided access to encrypted communications traffic. Typical: the intrusion detection and prevention systems and data loss prevention tools at the boundary]. The keys used for decryption shall be protected under the encryption and key management standard. (SI-4(10))
- The [Security operations team] shall alert [Fill in: personnel or roles to be alerted when indications of inappropriate or unusual activity with security or privacy implications occur. Typical: the security operations team and the system owner] using [Fill in: automated mechanisms used to alert personnel or roles. Typical: the security information and event management (SIEM) platform] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Fill in: activities that trigger alerts to personnel or. Typical: use of privileged accounts outside approved change windows, bulk downloads or exports of sensitive information, disabled security tools, and new administrative accounts]. (SI-4(12))
- A wireless intrusion detection system shall be employed to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system, covering the facilities where the system's components are located. (SI-4(14))
- The [Security operations team] shall implement the following additional monitoring of privileged users: [Fill in: additional monitoring of privileged users. Typical: recording of privileged sessions, alerts on high-risk privileged commands, and a review of privileged activity at least weekly]. (SI-4(20))
- The [Security operations team] shall detect network services that have not been authorized or approved by [Fill in: authorization or approval processes for network services. Typical: the change control process and the approved ports, protocols and services list], and when they are detected, shall [Select one or more: audit; alert [Assignment: organization-defined personnel or roles]. Typical: audit, and alert the security operations team and the system owner]. (SI-4(22))

## 10. Reporting

- The [Security operations team] shall provide [Fill in: system monitoring information to be provided to personnel or roles. Typical: alerts and monitoring reports] to [Fill in: personnel or roles to whom system monitoring information is to be provided. Typical: the system owner and the incident response team], [Select one or more: as needed; [Assignment: organization-defined frequency]. Typical: as needed, and at least monthly]. (SI-4g)
- Monthly reports shall cover, at a minimum, alerts by severity and outcome, time to triage against section 6, log source coverage against the component inventory, detections added, changed and retired, and incidents referred. (SI-4g)

### Federal systems

[OMB M-26-14](https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf), Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded OMB M-21-31. It directs agencies to prioritize two logging objectives, continuous event monitoring and threat hunting, investigation, response and forensics, for all information systems owned or operated by the agency or by third parties on its behalf. Each agency submits an Agency Logging Plan to OMB and CISA, following CISA's [Logging Reference Architecture](https://www.cisa.gov/resources-tools/resources/logging-reference-architecture) (published August 20, 2026), and reaches the levels of the memo's logging maturity model on its schedule. Its Appendix B sets minimum logging requirements, including retention, availability to the agency's top-level security operations center, accurate timestamps from a traceable time source, and logs that support a list of minimum activities. It does not apply to national security systems. As of September 2026.

- Each system's logs shall be actively searchable for at least 6 months after creation and retrievable for at least a year after creation, as OMB M-26-14 Appendix B requires, and kept longer where a records schedule requires it. (AU-11)
- Each system's logs shall be readily available to the agency's top-level security operations center. (SI-4c.1)
- Log timestamps shall be synchronized to a traceable time source the agency designates. (AU-8)
- Each system shall collect logs that support determining the identity used for operations; source and destination network addresses, protocols, ports and session attributes; access to, change or destruction of objects and data; changes to privilege levels; and changes to infrastructure, as OMB M-26-14 Appendix B item 5 requires. (SI-4c.1)
- The [Security operations team] shall use the logs to monitor for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, and generate automated alerts for them, as OMB M-26-14 Appendix B requires. (SI-4a.1)
- The system's log collection shall be described in, and kept consistent with, the agency's Agency Logging Plan. (SI-4c.1)
- In the event of a known or suspected compromise, the [Chief Information Security Officer] shall provide logs and other relevant data to CISA and the FBI on request, to the extent consistent with applicable law, as OMB M-26-14 requires. (SI-4g)

## 11. Review

The [Chief Information Security Officer] reviews this standard [Fill in: for example annually], and whenever the system and information integrity policy, the monitoring platforms, the threat environment or a federal logging requirement changes.

| Version | Date | Change | Approved by |
| --- | --- | --- | --- |
| [Fill in: version] | [Fill in: date] | [Fill in: summary of change] | [Fill in: name and title] |