SC-48 asks you to relocate sensors or monitoring capabilities under conditions you define. NIST explains why. Attackers move through paths the organization usually does not watch, and moving the monitoring can make their lateral movement harder.
800-53 binds federal systems and contractors. For others it is a reference, and one of the more advanced ones.
What it means in practice
Your monitoring covers the paths you expected. Threat information or an incident may tell you to look somewhere else. The control asks you to decide in advance when you will move sensors, and to be able to do it. The enhancement SC-48(1), Dynamic Relocation of Sensors or Monitoring Capabilities, goes further and makes it a routine.
Evidence to collect
- A map of where sensors and logs sit today.
- The written trigger conditions, such as a new threat report or a changed network layout.
- A record of at least one relocation or coverage review.
Common gaps
Sensors placed at launch and never reviewed. No record of why they sit where they do.
How to implement it
Review coverage after every major incident and every network change. Keep the review note.
Quick check
Why move sensors at all?
Attackers favor paths that are not monitored, so changing coverage reduces the places they can hide.
