164.308(a)(5)(ii)(C) Log-in Monitoring (Addressable)
Administrative safeguard · Addressable
The requirement as we hold it
Log-in Monitoring (Addressable). Implement procedures for monitoring log-in attempts and reporting discrepancies. NIST recommends automated alerts on failed authentication thresholds and anomalous login patterns.
The examiner asks
- Show me how you monitor log-in attempts and report discrepancies.
- What threshold triggers an alert, and where is the last alert?
Evidence to bring
- the log-in monitoring procedure
- the last login alert
Source: 164.308(a)(5)(ii)(C) at eCFR. Our statement of the clause, not the instrument verbatim.