11.5 — Intrusion detection and change detection

Requirement

Intrusion-detection and/or intrusion-prevention techniques detect or prevent intrusions into the network at the CDE perimeter and critical points, and a change-detection mechanism (such as file-integrity monitoring) alerts on unauthorised modification of critical files, with comparisons at least weekly.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.