# MON-09 Alerting and on-call coverage

Domain: MON Continuous Monitoring & Human Oversight · HI-AAF v1.3 · Public review · https://humanintel.net/standard/mon/mon-09

Alerting and on-call coverage are defined for critical agents.

Critical agents have defined alerting rules and on-call coverage ensuring that anomalies, incidents, and system failures are surfaced to a responsible human within a documented latency. Alerting is not just monitoring: it ensures that a human who can act is notified when action is needed, at any time of day.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for MON-09: Alerting rules are defined for all critical agents; on-call rotation is documented and staffed; alert response latency is measured; at least one alert has been responded to within SLA or the alerting pipeline has been tested end-to-end.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Alerting rules are defined for all critical agents.
- On-call rotation is documented and staffed.
- Alert response latency is measured.
- At least one alert has been responded to within SLA or the alerting pipeline has been tested end-to-end.

## Framework mappings

- NIST AI RMF: MANAGE 4.1
- SOC 2 (TSC): CC7.2, CC7.3
- EU AI Act: Art. 14(4)
- Singapore: MAIGF Incident Reporting

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, MON-09 Alerting and on-call coverage. Public review edition, July 2026. https://humanintel.net/standard/mon/mon-09