Crossfoot
Crossfoot / Controls / Intrusion detection and integrity monitoring
Draft v0.1.06 of 6 frameworks

Intrusion detection and integrity monitoring

Network intrusions and unauthorized changes to critical files or pages are detected and responded to.

Where it appears

SOC 2
CC7.2Monitors system components for anomalies
CC6.8Prevents or detects unauthorized or malicious software
PCI DSS 4.0
11.5Network intrusions and unexpected file changes are detected and responded to
11.6Unauthorized changes on payment pages are detected and responded to
NIST CSF 2.0
DE.CMContinuous monitoring
DE.AEAdverse event analysis
ISO 27001:2022
A.8.16Monitoring activities
HIPAA Security Rule
164.312(c)(1)Integrity
NIST 800-53 r5
SI-4System monitoring
SI-7Software, firmware and information integrity

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • IDS/IPS or EDR deployment evidence and coverage
  • File integrity monitoring configuration and alert samples
  • Evidence of alert triage and response
  • For PCI: payment-page change/tamper detection mechanism and weekly (or risk-based) evidence

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0