Continuous Monitoring (DE.CM)
Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events
Subcategories
DE.CM-01
Networks and network services are monitored to find potentially adverse events
DE.CM-02
The physical environment is monitored to find potentially adverse events
DE.CM-03
Personnel activity and technology usage are monitored to find potentially adverse events
DE.CM-04
Malicious code is detected
[Withdrawn: Incorporated into DE.CM-01, DE.CM-09]
DE.CM-05
Unauthorized mobile code is detected
[Withdrawn: Incorporated into DE.CM-01, DE.CM-09]
DE.CM-06
DE.CM-07
Monitoring for unauthorized personnel, connections, devices, and software is performed
[Withdrawn: Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09]
DE.CM-08
Vulnerability scans are performed
[Withdrawn: Incorporated into ID.RA-01]
DE.CM-09
Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events