id: "SI-04(20)" title: "Privileged Users" family: "SI" family_name: "System and Information Integrity" sort_id: "si-04.20" priority: "P1" implementation_level: "system" parent: "SI-04" enhancement: True
Statement
Implement the following additional monitoring of privileged users: {{ insert: param, si-04.20_odp }}.
Guidance
Privileged users have access to more sensitive information, including security-related information, than the general user population. Access to such information means that privileged users can potentially do greater damage to systems and organizations than non-privileged users. Therefore, implementing additional monitoring on privileged users helps to ensure that organizations can identify malicious activity at the earliest possible time and take appropriate actions.
Assessment Objective
{{ insert: param, si-04.20_odp }} of privileged users is implemented.
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
Organizational processes for system monitoring
mechanisms supporting and/or implementing a system monitoring capability