SFS 6 / SF 2

Back to SFS 6

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are security-relevant events from critical systems monitored through automated alerts that are reviewed and actioned within documented timeframes during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: alerts generated, reviewed, and actioned within documented timeframes

Assessment criterion and evidence

Actor: organization. Scope: critical systems. Evidence period: review period. Required evidence: alert logs showing generation; review records with timestamps; documented resolution actions. Negative criterion: no monitoring, ignored alerts, or delays beyond defined limits. Missing evidence: pending assessment due to unavailable evidence

View the JSON record (opens in a new tab).

Assessment result: unset.