# What evidence of attack detection in OT do auditors ask for?

Usually proof that detection exists, covers the right places and leads to action: which OT segments are monitored and how, which kinds of events are detected, who reviews alerts and how quickly, examples of alerts that were handled and what was decided, and how long the records are kept. In Germany, the Federal Office for Information Security (BSI) has published guidance on attack-detection systems for critical-infrastructure operators that auditors often use as a reference; other countries set their own expectations, so check with your national authority. A list of tools is not enough on its own: auditors look for a working process. A network map with first and last seen, alerts with timestamps and your notes on each decision make that process visible. NetSenX keeps alerts for your plan's alert history and, from the Pro plan, adds OT alerts for unauthorised writes, cross-level traffic, off-hours activity and S7comm commands. It does not certify you or replace the auditor's judgement.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/what-evidence-of-attack-detection-in-ot-do-auditors-ask-for

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [Are building management systems such as HVAC and BACnet a cyber risk?](https://netsenx.com/en/faq/are-building-management-systems-a-cyber-risk)
- [Can a hacked heating or access-control system be used to reach our office network?](https://netsenx.com/en/faq/can-a-hacked-heating-or-access-control-system-reach-the-office)
- [Is it normal for a CCTV recorder to connect to servers abroad?](https://netsenx.com/en/faq/is-it-normal-for-a-cctv-recorder-to-connect-to-servers-abroad)
- [Is a meeting-room TV that talks to unknown servers a risk?](https://netsenx.com/en/faq/is-a-meeting-room-tv-that-talks-to-unknown-servers-a-risk)
- [Why would our office printer connect to servers on the internet?](https://netsenx.com/en/faq/why-would-an-office-printer-connect-to-servers-on-the-internet)