DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
Personnel activity and technology usage are monitored to find potentially adverse events. Control from NIST Cybersecurity Framework 2.0 framework, domain: DE - Detect.
Source: NIST CSF 2.0, DE.CM-03. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST CSF 2.0 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- DLP policy library with detection telemetry · Data governance / DLP tooling
- Acceptable use monitoring notice and acknowledgement records · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- User and entity behavior analytics deployment scope · Policy repository / GRC workspace
- Insider risk indicator catalog with thresholds · Document repository
- Privileged session recording configuration · Policy repository / GRC workspace
First move
Common gaps auditors find
- Behavior baselines stale after org changes
- DLP only covers email, not cloud sharing
- Privileged sessions recorded but not reviewed
- Workforce notice not refreshed for new monitoring tools
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDE.CM-02 The physical environment is monitored to find potentially adverse events · DE.CM-06 External service provider activities and services are monitored to find potentially adverse events