Skip to content

Monitoring, Logging, and Auditing

Authorizing Log Access

KSI-MLA-ALA

Changelog:

  • 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.

Optional: A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity.

A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity.

Related SP 800-53 Controls: SI-11

Terms: Persistently

Evaluating Configurations

KSI-MLA-EVC

Changelog:

  • 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.

The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested.

Related SP 800-53 Controls: CA-7, CM-2, CM-6, SI-7.7

Terms: Information Resource, Machine-Based (Information Resources), Persistently

Logging Event Types

KSI-MLA-LET

Changelog:

  • 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.

A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur.

Related SP 800-53 Controls: AC-2.4, AC-6.9, AC-17.1, AC-20.1, AU-2, AU-7.1, AU-12, SI-4.4, SI-4.5, SI-7.7

Terms: Information Resource, Persistently

Operating SIEM Capability

KSI-MLA-OSM

Changelog:

  • 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.

A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.

Related SP 800-53 Controls: AC-17.1, AC-20.1, AU-2, AU-3, AU-3.1, AU-4, AU-5, AU-6.1, AU-6.3, AU-7, AU-7.1, AU-8, AU-9, AU-11, IR-4.1, SI-4.2, SI-4.4, SI-7.7

Terms: Persistently

Reviewing Logs

KSI-MLA-RVL

Changelog:

  • 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.

Logs are persistently reviewed and audited.

Related SP 800-53 Controls: AC-2.4, AC-6.9, AU-2, AU-6, AU-6.1, SI-4, SI-4.4

Terms: Persistently

Comments