You have been called to examine a system that has been compromised. You've been told the system has all of the necessary monitoring control in place. Which document would you consult to identify a list of monitoring controls