NIST CSF 2.0, DetectDE.CM-09

Maintain practices, capabilities, processes and tools to identify and assess cyber security weaknesses that external and insider threat actors could exploit, and design, implement and maintain multi-layer preventive controls and continuous security detection capabilities.

Implement a qualified system for detecting events capable of affecting your information systems' security, if you operate a public electronic communications network or provide a public electronic communications service in Djibouti. The detection system, and any service provider you use to run it, must be qualified by the national cybersecurity authority.

Formulate and implement your own cybersecurity program and cybersecurity framework consistent with the mandatory national cybersecurity frameworks the Administration issues, classify and protect your critical assets to the Administration's standard, create the cybersecurity organizational structure the national framework calls for, and establish and manage a center responsible for monitoring, reporting, and responding to cyberattacks.

Establish and implement an incident handling policy, monitor and log activity on your network and information systems to detect events that could be incidents, assess suspicious events to determine whether they are incidents, and assess the existence of recurring incidents under Article 4 on a quarterly basis (points 3.1.1, 3.2.1, 3.4.1 and 3.4.2(b)).

If you are a Class A company as 23 NYCRR 500.1(d) defines it, implement an endpoint detection and response solution to monitor anomalous activity, including lateral movement, and a solution that centralizes logging and security event alerting, unless your Chief Information Security Officer has approved in writing the use of reasonably equivalent or more secure compensating controls.

Strengthen risk monitoring of your data-processing activity, and on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures.

Establish mechanisms and processes to promptly detect a cybersecurity threat, vulnerability, or incident affecting your critical information infrastructure.

Establish mechanisms and processes to promptly detect a cybersecurity threat or incident affecting your critical information infrastructure.

As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.

Implement systems qualified to detect events likely to affect the security of your own information systems; the qualification of the detection systems and of the service providers operating them is delivered by the Ministry responsible for digital affairs, the Agence Nationale de Cybersécurité having been consulted.

Where the duty is triggered, maintain administrative, technical and organizational measures that: prevent unauthorized access to information and its transfer to a person without a right of access; detect an unauthorized access event in a timely manner; prevent adverse consequences from a breach of the access procedure; prevent disruption of the technical means used to process the information; permit immediate restoration of information altered or destroyed by unauthorized access; and continuously monitor the level of the information's protection.

At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.

Where appropriate to the risk, include measures to prevent, detect, respond to, resolve and control for data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and other model flaws.

Implement measures to detect and prevent cyber-attacks against vehicles of the type, support your monitoring of threats, vulnerabilities and cyber-attacks, and provide data forensic capability; mitigate threats and vulnerabilities that require a response within a reasonable timeframe, and monitor continually, including vehicles after first registration (paragraphs 7.3.7, 7.2.2.3 and 7.2.2.4).