Intermediate control principles for cyber incident detection (required, with baseline, of an AI whose inherent risk is medium). A normal network activity baseline is set; tools such as DLP detect unauthorised or unintended transmission of confidential data; critical assets are under security monitoring; a process finds infiltration before the attacker moves across systems, gains a foothold, steals information or damages data and systems; incidents are detected in real time with instant alerts to people who can act, such as the security monitoring function (in 2.0, continuous monitoring with defined escalation and root cause analysis); network and system alerts are correlated across business units. In 2.0, endpoint behavioural detection capability is available on endpoints and servers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.