10.4.3 Exceptions and anomalies identified during the review process are addressed.

Defined Approach Requirements

10.4.3 Exceptions and anomalies identified during the review process are addressed.

Customized Approach Objective

Suspicious or anomalous activities are addressed.

Applicability Notes

Defined Approach Testing Procedures

10.4.3.a Examine security policies and procedures to verify that processes are defined for addressing exceptions and anomalies identified during the review process.

10.4.3.b Observe processes and interview personnel to verify that, when exceptions and anomalies are identified, they are addressed.

Purpose

If exceptions and anomalies identified during the log-review process are not investigated, the entity may be unaware of unauthorized and potentially malicious activities occurring within their network.

Good Practice

Entities should consider how to address the following when developing their processes for defining and managing exceptions and anomalies:

• How log review activities are recorded,
• How to rank and prioritize exceptions and anomalies,
• What procedures should be in place to report and escalate exceptions and anomalies, and
• Who is responsible for investigating and for any remediation tasks.