11.5.1Network intrusions and unexpected file changes are detected and responded to

Defined Approach Requirements:

Intrusion-detection and/or intrusion-prevention techniques are used to detect and/or prevent intrusions into the network as follows:

- All traffic is monitored at the perimeter of the CDE.

- All traffic is monitored at critical points in the CDE.

- Personnel are alerted to suspected compromises.

- All intrusion-detection and prevention engines, baselines, and signatures are kept up to date.

Defined Approach Testing Procedures:

11.5.1.a Examine system configurations and network diagrams to verify that intrusion-detection and/or intrusion-prevention techniques are in place to monitor all traffic:

At the perimeter of the CDE.

At critical points in the CDE.

11.5.1.b Examine system configurations and interview responsible personnel to verify intrusion?detection and/or intrusion-prevention techniques alert personnel of suspected compromises.

11.5.1.c Examine system configurations and vendor documentation to verify intrusion-detection and/or intrusion-prevention techniques are configured to keep all engines, baselines, and signatures up to date.