Purpose

To ensure confidentiality, integrity, and availability of their information resources, a department must have a strategy to monitor systems and follow-up on unusual computer activity and events.

Scope

Departmental management, technology staff, and users.

Process Overview

1. Enable appropriate system event logging and other monitoring tools, as applicable.
2. Review event logs according to appropriate schedule (based on the role of the system).
3. Report unusual activity to appropriate personnel.
4. Raise end-user awareness to monitor odd or unusual activity.

References