What it asks for. Article 10 requires financial entities to have mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT related incidents, and to identify potential single points of failure. Detection should use multiple layers of control with defined alert thresholds.
In practice. The entity operates security monitoring with clear criteria for triggering incident response, allocates enough resources to monitor user activity and anomalies, and tests detection mechanisms regularly. Logs from relevant systems feed a central platform. Evidence includes monitoring coverage, alert thresholds, detection test results and staffing arrangements.
Common gaps. Detection may focus on cyber attacks and miss performance and availability anomalies. Thresholds are often defined once and not tested or tuned as systems and threats change.