head of a Department component to fully implement the detection, collection, and auditing of the following: (1) Sent and received emails, including sent attachments and emails sent outside of Federal Government domains. (2) Screen captures and print jobs, with focused attention on unusual volumes and times. (3) Accesses to World Wide Web Uniform Resource Locators and uploads and downloads involving nongovernment domains. (4) All instances in which a user creates, copies, moves to, or renames a file on removable media. (5) Secure file transfers, including on nonstandard ports. (6) Keystrokes. (7) Unauthorized research on user activity monitoring agents and techniques to disable user activity monitoring agents. (8) Attempts to clear event logs on devices. (9) Unauthorized applications being installed or run on an endpoint. (10) Installation and use of mounted drives, including serial numbers of such drives. (11) Initiation and control of an interactive session on a remote computer or virtual machine. (12) Instances where monitored users are denied access to a network location or resource. (13) Users uploading to or downloading from cloud services. (14) Administrative actions by privileged users, including remote and after-hour administrative actions, as well as document viewing, copy and paste activity, and file copying to new locations. (c) Additional requirements The Secretary shall require each head of a Department component to implement the following: (1) Automated controls to prohibit privileged user accounts from performing general user activities not requiring privileged access. (2) Two-person control whereby privileged users attempt to initiate data transfers from a classified domain and removable media-based data transfer activities on classified networks. (d) Establishing user activity monitoring behavior thresholds (1) In general The Secretary shall require each head of a Department component to implement standard triggers, alerts, and controls developed by the Under Secretary of Defense for