The IDPS must detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum.

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services.

Examples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.

To comply with this requirement, the IDPS may be configured to detect services either directly or indirectly (i.e., by detecting traffic associated with a service).

Verify the IDPS detects network services that have not been authorized or approved by the ISSO or ISSM, at a minimum.

If the IDPS does not detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum, this is a finding.

Configure the IDPS to detect network services that have not been authorized or approved by the ISSO or ISSM, at a minimum.