How do we answer “do you have intrusion detection?” on a customer questionnaire?
Precisely, with what you have, where, and who responds. A good answer names the type of detection (network, endpoint, or both), which sites and segments it covers, how alerts reach a person and how quickly, and what evidence you can provide. For example: network detection runs on the head-office and warehouse segments through a sensor on a mirror port; alerts are e-mailed to the IT manager and our IT provider; we keep an alert history and an audit log of decisions; endpoint protection runs on all laptops and servers. If something is missing, such as night cover, say so and say what you do instead. With NetSenX you can answer that network detection is in place on every plan, with an alert history, an audit log, PDF reports from the Starter plan and customer data stored in the EU.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.