Control: The organization monitors [Assignment: organization-defined open source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information.
Supplemental Guidance: Open source information includes, for example, social networking sites. Related controls: PE-3, SC-7.
monitoring for information disclosure | use of automated tools
The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.
Supplemental Guidance: Automated mechanisms can include, for example, automated scripts to monitor new posts on selected websites, and commercial services providing notifications and alerts to organizations.
monitoring for information disclosure | review of monitored sites
The organization reviews the open source information sites being monitored [Assignment: organization-defined frequency].
Control: The information system provides the capability for authorized users to select a user session to capture/record or view/hear.
Supplemental Guidance: Session audits include, for example, monitoring keystrokes, tracking websites visited, and recording information and/or file transfers. Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, or standards. Related controls: AC-3, AU-4, AU-5, AU-9, AU-11.
The information system initiates session audits at system start-up.
session audit | capture/record and log content
The information system provides the capability for authorized users to capture/record and log content related to a user session.
session audit | remote viewing / listening
The information system provides the capability for authorized users to remotely view/hear all content related to an established user session in real time.
References: None.
Priority and Baseline Allocation:
P0
LOW Not Selected
MOD Not Selected
HIGH Not Selected
AU-15 ALTERNATE AUDIT CAPABILITY
Control: The organization provides an alternate audit capability in the event of a failure in primary audit capability that provides [Assignment: organization-defined alternate audit functionality].
Supplemental Guidance: Since an alternate audit capability may be a short-term protection employed until the failure in the primary auditing capability is corrected, organizations may determine that the alternate audit capability need only provide a subset of the primary audit functionality that is impacted by the failure. Related control: AU-5.