3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in …

Requirement

To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives.

Guidance

• To minimise false positives and false negatives, to the extent feasible, consider one or more of the following (indicative, non-exhaustive list):
  • establish network traffic patterns;
  • use analytics and machine learning algorithms;
  • continuously update the automated monitoring tools to adapt to new threats and changes in the environment; and
  • fine-tune the parameters and thresholds based on the latest data and feedback.
• Where appropriate, ensure that all potential risks are properly covered by relevant use cases, for example use case for access to critical data, use case for data exfiltration or use case for ransomware infection, so that no critical threat goes undetected.

Examples of evidence

• Acceptable log monitoring, collection, storage and analysis tools, in line with the state of the art.
• Security Incident and Event Management (SIEM) systems used to analyse data and identify deviations from established patterns.
• Endpoint detection and response (EDR) and Extended Detection and Response (XDR) tools in place.
• Mechanisms that aim to minimise false positives and false negatives are in place.
• Where appropriate, mapping use cases to potential risks to ensure comprehensive and effective monitoring.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

Povezane zadeve

• ENISA -