Pillar 7: Visibility & Analytics
Provide visibility into user, device, application, and network activity so that relevant context can inform policy decisions and threat detection across every other pillar.
Key principles
- You can’t enforce policy on signals you don’t collect.
- Logging and monitoring are centralized, correlated, and continuously analyzed — not siloed per system.
- Analytics feed back into automation and policy decisions in near real time.
Maturity snapshot
| Stage | Characteristics |
|---|---|
| Traditional | Siloed logs, manual review |
| Advanced | Centralized SIEM with correlation rules across most systems; automated threat intel ingestion |
| Optimal | Behavioral analytics (UEBA) with automated risk scoring feeding policy decisions in real time |
Related capabilities
See Centralized Logging & SIEM and Threat Intelligence Integration in the capability matrix.
Framework tie-ins
NIST 800-53 (AU, RA families), NYDFS 500 (500.14), SOX (ITGC monitoring controls).
Capabilities in this pillar
Insider Threat Program
Reactive investigation only, after the fact
UEBA-driven insider risk scoring with defined triggers
Continuous, cross-pillar insider risk analytics feeding automated response
Centralized Logging & SIEM
Siloed logs, manual review
Centralized SIEM with correlation rules across most systems
Behavioral analytics (UEBA) with automated risk scoring feeding policy decisions
Third-Party & Fourth-Party Risk Visibility
Point-in-time vendor assessments
Continuous vendor security posture monitoring (ratings services)
Real-time vendor and subcontractor (fourth-party) risk visibility integrated into access and data-sharing decisions
Threat Intelligence Integration
Ad hoc, manual threat feed consumption
Automated ingestion into SIEM/SOAR for detection
Predictive analytics correlating threat intel with real-time access decisions