Part of Data Security Standard 6 - Responding to incidents
Monitoring (6.3.4)
You should be able to detect cyber events that can have an impact on your systems and services.
It's unlikely that you will have one monitoring solution in place. Monitoring and responding should be considered a multifaceted approach between people, processes and technology.
If you find the organisation has the technical capabilities to detect and log cyber events but not the people capacity to respond to them, this does not reduce your attack surface and makes you more liable to repeat data security incidents.
The NCSC has security monitoring guidance in its NIS collection
The organisation has a proportionate monitoring solution to detect cyber events on systems and services.
Last edited: 27 September 2022 11:12 am