NIST CSF 2.0, DetectDE.CM-03

Have transaction monitoring mechanisms that detect unauthorized or fraudulent payment transactions by analyzing payment transactions against what is typical of the payment service user in the circumstances of a normal use of the personalized security credentials, and take into account at a minimum lists of compromised or stolen authentication elements, the amount of each payment transaction, known fraud scenarios, signs of malware infection in any session of the authentication procedure and, where you provide the access device or software, a log of its use and its abnormal use (Article 2).

The Department states that the regulation requires you to monitor the activity of authorized users and email and web traffic to block malicious content and protect against the installation of malicious code, and says that if you use AI-enabled products or services or allow personnel to use AI applications you should also consider monitoring for unusual query behaviors that might indicate an attempt to extract nonpublic information and blocking queries that might expose it to a public AI product or system.

If you are a Class A company as 23 NYCRR 500.1(d) defines it, monitor privileged access activity and implement a privileged access management solution and an automated method of blocking commonly used passwords for all accounts on information systems you own or control and, wherever feasible, for all other accounts; where you determine that blocking is infeasible, your Chief Information Security Officer may instead approve in writing, at least annually, the infeasibility and the use of reasonably equivalent or more secure compensating controls.

Implement risk-based policies, procedures and controls designed to monitor the activity of authorized users (any employee, contractor, agent or other person that participates in your business operations and is authorized to access and use your information systems and data) and to detect unauthorized access or use of, or tampering with, nonpublic information by those authorized users.