de-dp-04-dedp-04

name	DE.DP-04_dedp-04
description	Event detection information is communicated
category	information-gathering
version	2.0
author	cyberstrike-official
tags	["nist","csf","v2.0","de-dp-04","de","subcategory"]
tech_stack	["aws","azure","gcp","siem"]
cwe_ids	["CWE-778"]
chains_with	[]
prerequisites	["Detection Processes (DE.DP)"]
severity_boost	{}

DE.DP-04 DE.DP-04

Subcategory of: Detection Processes (DE.DP)

High-Level Description

Function: DETECT (DE) Framework: NIST Cybersecurity Framework v2.0

Event detection information is communicated

What to Check

• Verify DE.DP-04 DE.DP-04 outcome is achieved
• Review documentation and evidence for DE.DP-04
• Assess organizational maturity for DETECT function
• Map to SP 800-53 controls that satisfy DE.DP-04

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for DE.DP-04.

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that DE.DP-04 outcome is met
# Interview stakeholders responsible for DETECT

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Assess cloud security posture	cloud_audit_* tools
Manual Review	Policy and procedure review	Interviews and documentation

Remediation Guide

Achieve the DE.DP-04 DE.DP-04 outcome:

Event detection information is communicated

Risk Assessment

Finding	Severity	Impact
DE.DP-04 DE.DP-04 outcome not achieved	High	DETECT Function Gap

CWE Categories

CWE ID	Title
CWE-778	Insufficient Logging

References

• NIST CSF v2.0
• NIST CSF v2.0 Reference Tool