The entity must set roles to detect and respond to incidents and anomalies. Its detection mechanism must collect, monitor and analyse internal and external factors (at least the Article 12 logs, information from business and ICT functions and user-reported problems), potential threats using common threat actor scenarios and threat intelligence, and incident notifications from ICT third-party providers; identify anomalies and generate alerts at least for assets supporting critical or important functions, including automated rule-based alerts on the completeness and integrity of data sources and log collection; prioritise alerts so incidents are handled within the expected resolution time in and out of hours; and record and evaluate all anomalies. Records of anomalies must be protected and must show occurrence time, detection time and type. Detection and response must be triggered by signs of malicious activity or compromise, data losses, adverse impact on transactions and operations, and system or network unavailability, considering the criticality of the services affected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.