SFS 6: Logging, Monitoring, and Incident Response
Assess whether relevant events are recorded, monitored, investigated, and handled through defined incident-response procedures.
Scope and boundaries
This set covers event sources, central log collection, record integrity, time consistency, monitoring coverage, alert handling, and incident escalation. It includes endpoint protection and deception mechanisms such as honeypots where they are part of the declared system. Questions should specify which events and services are monitored and what evidence demonstrates detection or response during the review period. Recovery after disruption belongs to SFS 2, while organizational authority and policy ownership belong to SFS D.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 0060 |
| 1 | SF 1 | 0061 |
| 2 | SF 2 | 0062 |
| 3 | SF 3 | 0063 |
| 4 | SF 4 | 0064 |
| 5 | SF 5 | 0065 |
| 6 | SF 6 | 0066 |
| 7 | SF 7 | 0067 |
| 8 | SF 8 | 0068 |
| 9 | SF 9 | 0069 |
| A | SF A | 006A |
| B | SF B | 006B |
| C | SF C | 006C |
| D | SF D | 006D |
| E | SF E | 006E |
| F | SF F | 006F |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.