NIST CSF 2.0, DetectDE.CM-01

Have mechanisms with multiple layers of control, alert thresholds and criteria that promptly detect anomalous activities, ICT network performance issues and ICT-related incidents and trigger incident response, test them regularly under Article 25, and devote sufficient resources to monitor user activity, ICT anomalies and ICT-related incidents. If you are a data reporting service provider, also have systems that check trade reports for completeness, identify omissions and obvious errors, and request re-transmission (Article 10).

If you operate a public network or provide a public service with increased hazard potential, use attack-detection systems that capture and evaluate threats continuously and automatically (Section 165(3)); as a network operator, use critical components only after a recognised certification body has examined and certified them (Section 165(4)), and undergo a review by a qualified independent body or competent national authority every two years, sending a copy of the report to the Bundesnetzagentur and the BSI and bearing the cost (Section 165(9)).

Adopt at least two-factor authentication for any user accessing the system from outside the bank or financial institution, fully encrypt highly sensitive data, filter inbound email, verify the security of devices employees use outside the institution, run penetration testing, monitor network traffic, and verify data integrity.

Receive CSIRT monitoring services from an internal CSIRT or an autonomous CSIRT that meets the requirements of article 9(1) (article 19(1)(d)).

The Department says you should consider confirming that intrusion prevention, detection and response controls are in use, up-to-date and appropriately deployed; that log and security event alerting data is captured and anomalous or suspicious activity is promptly identified and appropriately actioned; that appropriate personnel review and act on relevant threat intelligence, including known indicators of compromise and complete remediation steps; and that all personnel are alerted to the steps they can take against ongoing cyber threat campaigns, including social engineering.

Establish, for all assets within your cybersecurity perimeter, at least the capabilities of a cybersecurity operation center (CSOC): security logs from your systems and applications, security monitoring including intrusion detection and vulnerability assessment, analysis and the actions needed to protect the entity, and participation in the information collection and sharing Article 38 describes (Article 38(1), point (a)); you may procure these through managed security service providers but remain responsible for them and supervise their efforts (Article 38(1), point (b)).