Skip to main content
← All controls
SI-4(5) / IR-5 / AU-6(1) NIST SP 800-53 Rev 5

Reports actually reviewed by SecOps

Demonstrate that security monitoring reports are systematically reviewed by Security Operations staff, with documented evidence of analysis, triage, and responsive action within established service level agreements.

Description

What this control does

This control ensures that security monitoring reports generated by SIEM, IDS/IPS, vulnerability scanners, and other detection tools are actively reviewed by qualified Security Operations personnel within defined timeframes. It addresses the gap between automated alert generation and human analysis, requiring evidence that reports are opened, analyzed, and actioned rather than simply archived. The control typically includes documentation of review activities, analyst acknowledgment, case creation for findings, and escalation procedures for critical items.

Control objective

What auditing this proves

Demonstrate that security monitoring reports are systematically reviewed by Security Operations staff, with documented evidence of analysis, triage, and responsive action within established service level agreements.

Associated risks

Risks this control addresses

  • Security incidents remain undetected despite alerts being generated, allowing attackers persistent access or lateral movement
  • Compliance violations or data exfiltration go unnoticed due to unreviewed log analysis reports
  • High-priority vulnerability scan findings are not remediated because reports are auto-filed without human review
  • Alert fatigue leads to critical threat indicators being ignored among thousands of unexamined notifications
  • Insider threats succeed because user behavior analytics reports are generated but never analyzed
  • Regulatory penalties result from failure to demonstrate active monitoring during breach investigations
  • Security tooling investments provide no actual risk reduction because outputs are never consumed by analysts

Testing procedure

How an auditor verifies this control

  1. Obtain the list of all automated security monitoring tools configured to generate scheduled or threshold-based reports (SIEM, IDS/IPS, DLP, vulnerability scanners, UEBA, EDR platforms).
  2. Request the defined review procedures including assigned roles, review frequency requirements, and maximum time-to-review SLAs for each report type.
  3. Select a representative sample of 15-20 security reports spanning at least three monitoring tools and covering the most recent 30-day period.
  4. For each sampled report, retrieve audit logs from the report delivery system showing access timestamps, user identities, and duration of access.
  5. Cross-reference report access logs with ticketing system records to verify that findings resulted in documented cases, investigations, or remediation tasks.
  6. Interview 2-3 Security Operations analysts to validate their review process, ask them to demonstrate navigation of recent reports, and confirm their understanding of escalation thresholds.
  7. Compare actual review timestamps against defined SLAs to identify any reports that exceeded maximum review timeframes without documented exception approval.
  8. Verify that critical or high-severity findings from sampled reports have corresponding incident tickets, change requests, or risk acceptance documentation created within the required timeframe.
Evidence required Collect report generation logs showing creation timestamps and distribution lists; SIEM or report portal access logs demonstrating analyst authentication and report viewing activity with session durations; screenshots of ticketing system entries linking specific report findings to investigation cases with analyst assignment and timestamps; documented standard operating procedures defining review responsibilities and SLAs; interview notes with analyst statements and demonstration walkthroughs; email or collaboration platform records showing escalation of critical findings to management or incident response teams.
Pass criteria All sampled reports show documented evidence of review by authorized SecOps personnel within defined SLAs, with critical findings demonstrably escalated or actioned through the incident management process, and no systematic gaps in review coverage during the audit period.

Where this control is tested

Audit programs including this control

SOC 2 Vendor Evidence Check

Quick check on whether you are reviewing vendor SOC 2 reports properly — not just collecting them.

6 controls · v1.0