ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 10.2: Detect and manage cyber events to resolution: log analytics, response procedures integrated with incident management, updated monitoring and oversight of outsourced monitoring

What does 10.2 require?

Tooling gathers, consolidates and analyses logs and other data to detect cyber events, configured to monitor unexpected or anomalous changes, behaviour and activity by users, systems, processes and services across systems, networks and perimeter entry and exit points, with rules reviewed and updated regularly. Response procedures classify cyber events by severity, set technical resolution activities, escalation and reporting, and tie into the incident framework and the continuity plan; monitoring stays current with new threats including scanning for indicators of compromise; and where cyber event management is outsourced, due diligence and ongoing oversight apply with visibility of institution-specific monitoring rules and escalation protocols, regular case reporting and integration of the third party's response into the incident framework.