Does your organization document and maintain baselines of expected communication patterns and data flows with third parties?
Explanation
Establishing and maintaining baselines of communication and data flows with third parties helps detect anomalous activities that could indicate security incidents.
These baselines should document expected network traffic patterns, data exchange volumes, access requirements, and communication protocols between your organization and each third party.
Regular reviews of these baselines against actual traffic can reveal unauthorized changes or potential security breaches.
Evidence could include documented communication and data flow diagrams, network traffic baseline reports, third-party connection inventories, or data exchange specifications that clearly outline expected patterns and thresholds for each third-party relationship.
Implementation Example
Maintain baselines of communication and data flows between the organization and third parties
ID: ID.AM-03.126
Context
- Function
- ID: IDENTIFY
- Category
- ID.AM: Asset Management
- Sub-Category
- Representations of the organization's authorized network communication and internal and external network data flows are maintained
Related questions
- Does your organization maintain comprehensive inventories of all hardware assets, including IT equipment, IoT devices, operational technology (OT), and mobile devices?
- Does your organization implement automated network monitoring to detect new hardware and update inventory records in real-time?
- Does your organization maintain a comprehensive inventory of all software and services, including commercial, open-source, custom, API, and cloud-based applications?
- Does your organization implement continuous monitoring for software and service inventory changes across all platforms, including containers and virtual machines?
- Does your organization maintain a comprehensive inventory of all systems within your environment?
- Does your organization maintain documented baselines of expected network communication patterns and data flows for both wired and wireless networks?
