2 Auditable Events AU-2a, Certain events must be continuously AU-2d Frequency: continually monitored. AU-2a auditable events: Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes 3 Information System CM-8(3)a CSPs must be able to detect new This activity should be Component Inventory assets continuously, using automated automated. mechanisms with a maximum delay in detection. 4 Incident Reporting IR-6 CSPs must report incidents in accordance with the FedRAMP IR-6a. [US-CERT incident Incident Communications Procedure. reporting timelines as specified in NIST Special Publication 800-61 (as amended)] 5 Temperature & PE-14b CSPs must monitor temperature and Refer to ASHRAE Thermal Humidity Controls humidity controls continuously. Guidelines for Data Processing Environments. Requirements: The service provider measures temperature at server inlets and humidity levels by dew point.
2 Auditable Events AU-2a, Certain events must be continuously monitored. AU-2a auditable events: Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes AU-2d Frequency: continually 3 Information System Component Inventory CM-8(3)a CSPs must be able to detect new assets continuously, using automated mechanisms with a maximum delay in detection. This activity should be automated. 4 Incident Reporting IR-6 CSPs must report incidents in accordance with the FedRAMP Incident Communications Procedure. IR-6a. [US-CERT incident reporting timelines as specified in NIST Special Publication 800-61 (as amended)] 5 Temperature & Humidity Controls PE-14b CSPs must monitor temperature and humidity controls continuously. Refer to ASHRAE Thermal Guidelines for Data Processing Environments. Requirements: The service provider measures temperature at server inlets and humidity levels by dew point.
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3.docx