System Monitoring Standard template: The monitoring objectives, log sources, detections, alert handling, retention and reporting that make the system and information integrity policy's monitoring requirements (SP 800-53 SI-4) measurable, with audit record review (AU-6) and retention (AU-11).
The monitoring objectives, log sources, detections, alert handling, retention and reporting that make the system and information integrity policy’s monitoring requirements (SP 800-53 SI-4) measurable, with audit record review (AU-6) and retention (AU-11).
This standard sets the minimum requirements for monitoring the systems of Organization name to detect attacks, unauthorized connections and unauthorized use, and for handling what monitoring finds. It applies to every system in the system inventory and every component in each system’s component inventory, including cloud services, identity services, endpoints, network and security devices, and systems that providers operate for the organization.
Owns this standard and the monitoring program; provides the monitoring platforms; obtains legal review of monitoring; decides when the level of monitoring changes
Security operations team
Runs the SIEM platform and detection tools; writes, tunes and tests detections; triages alerts around the clock or at the hours set below; refers suspected incidents; reports on monitoring
System owner
Makes sure every component sends its logs and runs the monitoring agents; tells the Security operations team about new components and changes; owns application-specific detections; acts on alerts about the system
Incident response team
Handles incidents that monitoring refers to it under the incident response plan
Each system shall be monitored to detect attacks and indicators of potential attacks in accordance with the following monitoring objectives: Fill in: monitoring objectives to detect attacks and indicators of potential attacks on the system Typical: detecting attacks, malware, unauthorized access, privilege misuse and data exfiltration. (SI-4a.1)
Each system shall be monitored to detect unauthorized local, network and remote connections. (SI-4a.2)
The Chief Information Security Officer shall obtain a legal opinion on system monitoring activities before they begin and whenever they change significantly, including any decryption of traffic and any monitoring of individual users, and shall keep the opinion on record. (SI-4f)
Systems shall display a system use notification that tells users their activity may be monitored. (AC-8)
Monitoring capabilities shall be deployed strategically within each system to collect the essential information the monitoring objectives call for, including at the managed interfaces in the boundary protection standard. (SI-4c.1)
Each system shall send the log sources in the table below to Fill in: for example the SIEM platform, or make them available to it, within Fill in: for example 15 minutes of the event. (SI-4c.1)
Endpoint detection and response shall run on every server and workstation that supports it. (SI-4c.1)
Monitoring capabilities shall be deployable at ad hoc locations within each system to track specific types of transactions of interest, such as during an investigation. (SI-4c.2)
The Security operations team shall compare the log sources received with each system’s component inventory Fill in: for example monthly, and report components that send no logs, or have stopped, to the system owner. (SI-4c.1)
Log sources shall use a common time source, so that events from different sources can be put in order. (AU-8)
Log source
Examples
Required for
Identity and access
Fill in: for example the identity provider, directory services, single sign-on, multifactor authentication and privileged access management
Fill in: for example all systems
Endpoints
Fill in: for example endpoint detection and response, operating system security logs
Fill in: for example all servers and workstations
Network and boundary
Fill in: for example firewalls, proxies, DNS, VPN or zero trust access, intrusion detection and prevention, network flow records
Fill in: for example all managed interfaces
Cloud control plane
Fill in: for example cloud provider audit logs, configuration changes and threat detection findings
Fill in: for example all cloud accounts
Applications and databases
Fill in: for example authentication, authorization failures, administrative actions and access to sensitive records
Fill in: for example systems that process sensitive information
Email and collaboration
Fill in: for example email gateway, mailbox audit and file sharing logs
Fill in: for example the enterprise services
Security tools
Fill in: for example malicious code protection, data loss prevention and vulnerability scanning results
Unauthorized use of each system shall be identified through Fill in: techniques and methods used to identify unauthorized use of the system Typical: log correlation in the security information and event management (SIEM) platform, endpoint detection and response, network intrusion detection and user behavior analytics. (SI-4b)
The Security operations team shall employ automated tools and mechanisms, such as correlation rules in the SIEM platform and endpoint detection and response, to support near real-time analysis of events. (SI-4(2))
The Security operations team shall determine and document criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic. (SI-4(4)(a))
Inbound communications traffic shall be monitored Fill in: the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions Typical: continuously for Fill in: unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic Typical: connections from known malicious sources, unapproved protocols and ports, and scanning or password-guessing patterns. (SI-4(4)(b))
Outbound communications traffic shall be monitored Fill in: the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions Typical: continuously for Fill in: unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic Typical: connections to known malicious destinations, unusual data volumes, unapproved protocols and regular beaconing to external hosts. (SI-4(4)(b))
Each system shall alert Fill in: personnel or roles to be alerted when indications of compromise or potential compromise occur Typical: the security operations team when the following system-generated indications of compromise or potential compromise occur: Fill in: compromise indicators Typical: indicators of compromise from the detection tools and threat intelligence feeds. (SI-4(5))
Each detection shall be recorded with what it detects, its data sources, its severity, its owner and the response it calls for, and mapped to the attack techniques it covers where the organization uses a catalog of techniques. (SI-4b)
Detections shall be tested Fill in: for example when written and at least annually, and tuned when they produce false positives, so that they still fire on the activity they are meant to catch. (SI-4b)
Threat intelligence feeds that supply indicators of compromise and known malicious sources and destinations shall be kept current. (SI-4(5))
The Security operations team shall triage alerts Fill in: for example around the clock, directly or through a managed security service. (SI-4d)
The Security operations team shall analyze detected events and anomalies, and refer suspected incidents to the Incident response team under the incident response plan. (SI-4d)
Each alert shall be closed only with a recorded outcome: false positive, benign, or referred as a suspected incident, with a short note of what was checked. (SI-4d)
Alert severity
Triage begins within
Examples
Critical
Fill in: for example 15 minutes
Fill in: for example confirmed malware execution, a known indicator of compromise, a disabled security tool
High
Fill in: for example 1 hour
Fill in: for example suspicious privileged activity, traffic to a known malicious destination
Medium
Fill in: for example 8 hours
Fill in: for example repeated failed logons, an unapproved service
Low
Fill in: for example 3 business days
Fill in: for example policy violations with no sign of compromise
The Security operations team shall review and analyze system audit records Fill in: frequency at which system audit records are reviewed and analyzed Typical: continuously through automated alerting, with a documented manual review at least weekly for indications of Fill in: inappropriate or unusual activity Typical: the activity listed in the log review procedure, such as repeated failed logons, privilege escalation and access outside normal patterns and its potential impact, and report findings to Fill in: personnel or roles to receive findings from reviews and analyses of system records Typical: the system owner and the incident response team. (AU-6a, AU-6b)
Each manual review shall leave a dated record of what was reviewed, what was found and to whom it was reported. (AU-6a)
Audit records and monitoring data shall be retained for Fill in: a time period to retain audit records that is consistent with the records retention policy Typical: at least one year, or longer where the records retention schedule or a law requires it, to support after-the-fact investigation of incidents and to meet regulatory and organizational retention requirements. (AU-11)
Monitoring data shall be kept Fill in: for example 6 months in a form that can be searched at once, and the rest of the retention period in a form that can be restored for search when needed. (AU-11)
The Chief Information Security Officer shall adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations or the Nation, such as a relevant threat advisory, an incident, or a major change to the system. (SI-4e)
The Security operations team shall adjust the level of audit record review, analysis and reporting when law enforcement information, intelligence information or other credible sources indicate a change in risk. (AU-6c)
Each increase and its end shall be recorded with the reason and what changed. (SI-4e)
Provisions shall be made so that Fill in: encrypted communications traffic to be made visible to system monitoring tools and mechanisms Typical: encrypted traffic crossing the internet connection and the public-facing subnetwork, except categories exempted after legal and privacy review, such as health and financial sites is visible to Fill in: system monitoring tools and mechanisms to be provided access to encrypted communications traffic Typical: the intrusion detection and prevention systems and data loss prevention tools at the boundary. The keys used for decryption shall be protected under the encryption and key management standard. (SI-4(10))
The Security operations team shall alert Fill in: personnel or roles to be alerted when indications of inappropriate or unusual activity with security or privacy implications occur Typical: the security operations team and the system owner using Fill in: automated mechanisms used to alert personnel or roles Typical: the security information and event management (SIEM) platform when the following indications of inappropriate or unusual activities with security or privacy implications occur: Fill in: activities that trigger alerts to personnel or Typical: use of privileged accounts outside approved change windows, bulk downloads or exports of sensitive information, disabled security tools, and new administrative accounts. (SI-4(12))
A wireless intrusion detection system shall be employed to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system, covering the facilities where the system’s components are located. (SI-4(14))
The Security operations team shall implement the following additional monitoring of privileged users: Fill in: additional monitoring of privileged users Typical: recording of privileged sessions, alerts on high-risk privileged commands, and a review of privileged activity at least weekly. (SI-4(20))
The Security operations team shall detect network services that have not been authorized or approved by Fill in: authorization or approval processes for network services Typical: the change control process and the approved ports, protocols and services list, and when they are detected, shall Select one or more: audit; alert [Assignment: organization-defined personnel or roles] Typical: audit, and alert the security operations team and the system owner. (SI-4(22))
The Security operations team shall provide Fill in: system monitoring information to be provided to personnel or roles Typical: alerts and monitoring reports to Fill in: personnel or roles to whom system monitoring information is to be provided Typical: the system owner and the incident response team, Select one or more: as needed; [Assignment: organization-defined frequency] Typical: as needed, and at least monthly. (SI-4g)
Monthly reports shall cover, at a minimum, alerts by severity and outcome, time to triage against section 6, log source coverage against the component inventory, detections added, changed and retired, and incidents referred. (SI-4g)
OMB M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded OMB M-21-31. It directs agencies to prioritize two logging objectives, continuous event monitoring and threat hunting, investigation, response and forensics, for all information systems owned or operated by the agency or by third parties on its behalf. Each agency submits an Agency Logging Plan to OMB and CISA, following CISA’s Logging Reference Architecture (published August 20, 2026), and reaches the levels of the memo’s logging maturity model on its schedule. Its Appendix B sets minimum logging requirements, including retention, availability to the agency’s top-level security operations center, accurate timestamps from a traceable time source, and logs that support a list of minimum activities. It does not apply to national security systems. As of September 2026.
Each system’s logs shall be actively searchable for at least 6 months after creation and retrievable for at least a year after creation, as OMB M-26-14 Appendix B requires, and kept longer where a records schedule requires it. (AU-11)
Each system’s logs shall be readily available to the agency’s top-level security operations center. (SI-4c.1)
Log timestamps shall be synchronized to a traceable time source the agency designates. (AU-8)
Each system shall collect logs that support determining the identity used for operations; source and destination network addresses, protocols, ports and session attributes; access to, change or destruction of objects and data; changes to privilege levels; and changes to infrastructure, as OMB M-26-14 Appendix B item 5 requires. (SI-4c.1)
The Security operations team shall use the logs to monitor for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, and generate automated alerts for them, as OMB M-26-14 Appendix B requires. (SI-4a.1)
The system’s log collection shall be described in, and kept consistent with, the agency’s Agency Logging Plan. (SI-4c.1)
In the event of a known or suspected compromise, the Chief Information Security Officer shall provide logs and other relevant data to CISA and the FBI on request, to the extent consistent with applicable law, as OMB M-26-14 requires. (SI-4g)
The Chief Information Security Officer reviews this standard Fill in: for example annually, and whenever the system and information integrity policy, the monitoring platforms, the threat environment or a federal logging requirement changes.
Version
Date
Change
Approved by
Fill in: version
Fill in: date
Fill in: summary of change
Fill in: name and title
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.