- Home
- All questions
- Question 380
CISM study material · question 380 of 1000
An organisation monitors its own networks and endpoints continuously but performs no monitoring of the managed service provider operating part of its estate. Which CSF 2.0 outcome is missing?
Show the answer
Answer: D. What external service providers do, and the services they run, are watched for adverse events
CSF 2.0's DE.CM-06 extends continuous monitoring beyond the organisation's own estate to the providers operating parts of it — the gap here.
Source: NIST CSWP 29 (NIST) — Appendix A DE.CM-06