Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records DE-0001 against CM-3 Configuration Change Control; SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps DE-0001 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records DE-0002.02 against SI-4 System Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps DE-0002.02 to countermeasure CM0034 Monitor Critical Telemetry Points, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records DE-0002.03 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps DE-0002.03 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records DE-0003.08 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps DE-0003.08 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0034 Monitor Critical Telemetry Points; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records DE-0009.04 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps DE-0009.04 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0034 Monitor Critical Telemetry Points, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0002 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0002 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0003 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0003 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0005 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0005 to countermeasure CM0014 Secure boot; CM0028 Tamper Protection; CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0006 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0006 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0009.03 against CA-7 Continuous Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0009.03 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management; CM0049 Machine Learning Data Integrity, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.02 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.02 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.04 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.04 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.05 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.05 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.06 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.06 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.07 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.07 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.08 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.08 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management; CM0066 Model-based System Verification, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.09 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.09 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.10 against SI-7 Software, Firmware, and Information Integrity, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0012.10 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0042 Robust Fault Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EXF-0004 against SI-4 System Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EXF-0004 to countermeasure CM0036 Session Termination, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EXF-0010 against SI-4 System Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EXF-0010 to countermeasure CM0036 Session Termination, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records IA-0003 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps IA-0003 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0034 Monitor Critical Telemetry Points; CM0036 Session Termination, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records IA-0008.02 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps IA-0008.02 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0034 Monitor Critical Telemetry Points, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records LM-0003 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps LM-0003 to countermeasure CM0032 On-board Intrusion Detection & Prevention; CM0034 Monitor Critical Telemetry Points; CM0036 Session Termination, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records PER-0001 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps PER-0001 to countermeasure CM0014 Secure boot; CM0023 Configuration Management; CM0028 Tamper Protection, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records PER-0002 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps PER-0002 to countermeasure CM0001 Protect Sensitive Information; CM0014 Secure boot; CM0023 Configuration Management, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records REC-0005.02 against AC-4 Information Flow Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps REC-0005.02 to countermeasure CM0036 Session Termination, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.