Monitor continuously for signs of attack: for hardware and software, connection of unapproved or non-compliant hardware, installation of unapproved software, tampering at software and firmware updates, suspicious behaviour on servers and endpoints, and patch status; for networks, intrusion (IPS, IDS), traffic anomalies such as DDoS, unauthorised or unusual connections and data transfers, and connections to malicious websites, unapproved social media and file-sharing services; for staff access, suspicious behaviour such as unusual access patterns; access by external service providers (maintenance); analyse whether a sign is an incident (scope and severity) and report promptly to the responsible officer; verify alert criteria and thresholds regularly; and monitor entry to and suspicious activity in data centres and server rooms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.