How do we show an auditor which parts of our network are monitored?
With a simple coverage statement backed by evidence, including the gaps. List each site and network segment, whether a sensor or agent watches it, since when, and what it covers; then mark what is not watched, such as guest Wi-Fi, a branch office or a cloud environment, and how you handle it instead. Attach evidence: the sensor list, a recent alert from each monitored segment, and the network map. Auditors trust an honest statement with known gaps more than a claim of full coverage that falls apart on the first question. In NetSenX, one agent on a switch's mirror port (SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.) or a network TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. watches a whole segment, and the dashboard shows which agents run where; traffic on a segment you do not mirror stays out of view, and NetSenX does not pretend otherwise.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What does network detection miss if a segment is not mirrored?
- What should an incident log contain for a NIS2 audit?
- How do we show an auditor what we decided on each security alert?
- How long must we keep security incident records?
- Can a network map be generated automatically from traffic for an auditor?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
← All 35 questions on Incident reporting deadlinesAll topics