What it asks for. This Detect category requires that assets are monitored to find anomalies, indicators of compromise and other potentially adverse events. DE.CM-1 in CSF 1.1 specifically addressed monitoring the network to detect potential cybersecurity events.
In practice. The organisation monitors networks, endpoints, user activity, physical environments, external service providers and cloud services, with defined coverage and alerting. Network monitoring uses flow data, intrusion detection, DNS logging and similar telemetry, and monitoring is tuned to known threats. Evidence includes monitoring coverage maps, use case lists and alert handling records.
Common gaps. Coverage gaps are common in cloud environments, remote work and third party connections. Monitoring tools are deployed but under tuned, producing noise that hides real events.