Detect 2.4.2 Security continuous monitoring Ensure that ICT systems, including all assets, are monitored at regular intervals to detect cybersecurity incidents, and also to verify the effectiveness of protective measures. Description Task DE.CM-1 Monitor networks continuously to detect potential cybersecurity events. DE.CM-2 Continuous monitoring/surveillance of all physical assets and buildings to detect cybersecurity incidents. DE.CM-3 Establish a system to monitor ICT use on the part of your staff, to detect potential cybersecurity incidents. DE.CM-4 Ensure that malware can be detected. DE.CM-5 Ensure that malware can be detected on mobile devices. DE.CM-6 Ensure that the activities of external service providers can be monitored so that cybersecurity incidents can be detected. DE.CM-7 Monitor your system continuously to ensure that activities or access by unauthorised persons, devices and software are detected. DE.CM-8 Perform vulnerability scans. Table 29: DE.CM tasks Standard Reference COBIT 5 DSS05.01, DSS05.07, APO07.06, BAI03.10 ISA 62443-3:2013 SR 6.2, SR 3.2, SR 2.4 ISO 27001:2013 A.12.4.1, A.12.2.1, A.12.5.1, A.14.2.7, A.15.2.1, A.12.6.1 NIST-SP-800-53 Rev. 4 AC-2, AU-12, CA-7, CM-3, SC-5, SC-7, SI-4, AU-13, CM-10, CM-11, SI-3, SC-18, SI-4, SC-44, PS-7, SA-4, SA-9, CM-8, PE-3, PE-6, PE-20, SI-4, AU-12, RA-5 BSI B 5.22, M 2.500, B 1.6, B 2.9, B 1.9, B 5.25, B 1.11, M 2.256, M 2.35 Table 30: DE.CM references Minimum ICT standard 2018 28