DE.CM-03 says personnel activity and technology usage are monitored to find potentially adverse events. That means you can spot a stolen account, a careless admin or an insider acting badly, using logs of who did what on your systems. It does not mean watching every keystroke.
What good looks like
Sign in logs, privileged actions and access to sensitive data are recorded and reviewed. Alerts fire for impossible travel, repeated failed logins, new admin grants and bulk downloads. Staff know monitoring exists because your policy says so.
How to implement it
- Collect logs from your identity provider, cloud console, source code host and file storage.
- Define a short list of risky events: new admin role, disabled MFA, mass export, login from a new country.
- Route those alerts to a named person with a response time.
- Consider planting a decoy account or file that nobody should touch, and alert on any use.
- Tell employees what is monitored and why, and involve HR and legal on the policy wording.
Evidence to collect
- The monitoring policy and its acknowledgment records.
- Alert rules for the risky events list.
- Two or three alerts with the investigation notes.
- A quarterly review of privileged activity.
Common gaps
Only failed logins are watched. Admin activity in the cloud console is not logged. Departed staff accounts stay active and unwatched.
Quick check
Do we need behavior analytics software?
Not to start. Clear rules on a few risky events, sent to someone who acts on them, meet the intent for most small companies.
Sources
- NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool and implementation examples: https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters
