Skip to main content
← All controls
IR-4 / IR-5 / SI-4 NIST SP 800-53 Rev 5

Do you have visibility into who clicked a phishing link or entered credentials on a phishing site?

Demonstrate that the organization maintains technical and procedural capabilities to identify and track employees who clicked phishing links or submitted credentials on phishing sites within a timeframe sufficient for timely response.

Description

What this control does

This control establishes the organization's capability to identify employees who have interacted with phishing attacks by clicking malicious links or submitting credentials on fraudulent sites. Detection mechanisms typically include security email gateway logging, endpoint detection and response (EDR) telemetry, web proxy logs, security information and event management (SIEM) correlation rules, and specialized anti-phishing platforms that track click-through and credential submission events. Effective visibility enables rapid incident response, targeted user remediation, credential resets, and data-driven security awareness program improvements.

Control objective

What auditing this proves

Demonstrate that the organization maintains technical and procedural capabilities to identify and track employees who clicked phishing links or submitted credentials on phishing sites within a timeframe sufficient for timely response.

Associated risks

Risks this control addresses

  • Compromised credentials remain undetected and are used for unauthorized access to corporate systems and data
  • Initial phishing compromise escalates to ransomware deployment or data exfiltration without detection
  • Lack of victim identification prevents timely password resets and account lockdowns following credential harvesting attacks
  • Security awareness training cannot be targeted to high-risk users without visibility into actual phishing victimization
  • Incident response teams cannot assess blast radius or identify lateral movement originating from compromised accounts
  • Compliance violations occur when breached credentials lead to unauthorized access to regulated data without detection
  • Repeat phishing victims remain unidentified, creating persistent attack surface for threat actors

Testing procedure

How an auditor verifies this control

  1. Inventory all technical systems deployed to detect phishing link clicks and credential submissions, including email security gateways, web proxies, EDR platforms, SIEM solutions, and dedicated anti-phishing tools
  2. Review configuration settings in identified systems to verify logging is enabled for URL click events, authentication submissions to known-bad domains, and phishing-related security alerts
  3. Request documentation of phishing detection use cases, correlation rules, and alert definitions currently deployed in monitoring systems
  4. Select a sample of 10-15 recent phishing simulation exercises or actual phishing incidents from the past 12 months
  5. For each sampled incident, request evidence showing identified victims including usernames, timestamps of clicks or credential submissions, and URLs accessed
  6. Verify that detection occurred within a reasonable timeframe by comparing phishing event timestamps to detection/alert timestamps in security logs
  7. Interview security operations personnel to confirm the workflow for receiving phishing victim notifications, validating findings, and initiating response actions
  8. Test detection capability by simulating a phishing click or requesting evidence from the most recent sanctioned phishing simulation showing individual-level tracking data
Evidence required Auditor collects system configuration exports from email security gateways and web proxies showing URL filtering and logging enabled; SIEM correlation rules or detection logic for phishing indicators; sample security incident reports or phishing simulation results displaying individual victim identification with usernames, timestamps, and clicked URLs; screenshots of dashboards or reporting interfaces showing phishing victim tracking; and interview notes or documented procedures describing the phishing detection and notification workflow.
Pass criteria The control passes if the organization can demonstrate technical capability to identify specific users who clicked phishing links or submitted credentials, provide evidence of actual victim identification from recent incidents or simulations with individual-level granularity, and show detection occurred within a timeframe enabling effective incident response.