DE.CM-01 Network monitoring
Monitoring networks and network services such as DNS and BGP for adverse events, unauthorized endpoints, rogue wireless networks and deviations from baseline flows.
DE.CM Continuous monitoring
Continuous Monitoring: monitoring networks, the physical environment, personnel activity, external service providers and computing and runtime environments; five Subcategories.
DE.CM-02 Physical environment monitoring
Monitoring the physical environment for adverse events: badge reader logs, visitor records, tamper checks on locks and alarms, cameras and guards.
DE.CM-03 Personnel activity monitoring
Monitoring personnel activity and technology use: user behavior analytics for insider threats, logical access logs for unusual patterns and failed attempts, and deception technology.
DE.CM-06 External provider monitoring
Monitoring external service provider activity: remote and onsite administration and maintenance by providers, and cloud and internet service provider activity against expected behavior.
DE.CM-09 Computing and runtime monitoring
Monitoring hardware, software, runtime environments and data: email, web and collaboration attack vectors, authentication attempts, configuration drift, tampering and endpoint health.
