3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in …

Requirement

To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives.

Guidance

• To minimise false positives and false negatives, to the extent feasible, consider one or more of the following (indicative, non-exhaustive list):
  • establish network traffic patterns;
  • use analytics and machine learning algorithms;
  • continuously update the automated monitoring tools to adapt to new threats and changes in the environment; and
  • fine-tune the parameters and thresholds based on the latest data and feedback.
• Where appropriate, ensure that all potential risks are properly covered by relevant use cases, for example use case for access to critical data, use case for data exfiltration or use case for ransomware infection, so that no critical threat goes undetected.

Examples of evidence

• Acceptable log monitoring, collection, storage and analysis tools, in line with the state of the art.
• Security Incident and Event Management (SIEM) systems used to analyse data and identify deviations from established patterns.
• Endpoint detection and response (EDR) and Extended Detection and Response (XDR) tools in place.
• Mechanisms that aim to minimise false positives and false negatives are in place.
• Where appropriate, mapping use cases to potential risks to ensure comprehensive and effective monitoring.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

3. Regolamenti relatati

Kwistjonijiet marbuta

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.