Implementation Guide › Preparing Your Endpoint Implementation › Using a Warning Period

Using a Warning Period

In addition to deciding what to protect, the implementation team must consider how to phase in the new security controls. To minimize disruption to current work patterns, you should consider an initial period in which you only monitor access to resources, rather than enforcing access restrictions.

You can monitor access by putting the resources into Warning Mode. When Warning Mode is enabled for a resource or a class, and user access violates access restrictions, CA ControlMinder records a Warning message in the audit log, and gives the user access to the resource.

Note: If you use Warning Mode, consider increasing the maximum size of the audit logs. For more information about Warning Mode, see the Endpoint Administration Guide.