What it asks for. This control asks organisations to operate processes and tooling that provide comprehensive monitoring of and defence against threats across their network. It includes centralised alerting, intrusion detection or prevention, segmentation and traffic filtering.
In practice. Mature teams correlate network and host telemetry in a central platform, deploy intrusion detection or network detection and response at key points, and filter traffic between segments. Port level access control, remote device posture checks and flow logging support investigations. A security operations function, internal or outsourced, tunes detection and handles alerts. Evidence includes architecture showing monitoring points, alert handling metrics and tuning records.
Common gaps. Visibility of east west traffic and cloud networks is often weak, and alert fatigue leads to untuned rules being ignored. Segmentation plans exist on paper but are not enforced.