The dutyholder or its provider monitors the security of networks and systems supporting categorised functions, including those protecting SNI, based on network baselines and common attack methods, with multi-layer coverage from hosts to gateways, alternative measures where systems cannot provide host monitoring, new systems added as data sources, detection of indicators of compromise and user policy violations, and out-of-hours monitoring and escalation. Where monitoring is outsourced the dutyholder can still respond.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.