CC7.2 - Monitor System Components for Anomalies

CC7.2 requires organizations to continuously monitor the operation of system components to detect unusual or unexpected behavior that could indicate a security event, performance problem, or failure. The criterion calls for documented procedures, logging, and alerting mechanisms that identify anomalies, assess their impact, and trigger timely investigation and response to protect the confidentiality, integrity, and availability of the system.