What it asks for. This category covers insufficient logging, detection, monitoring and active response in applications. Without them, breaches cannot be detected, investigated or stopped in time, so attackers can continue undetected.
In practice. Good practice is logging security-relevant events such as logins, failed logins, access control failures and high-value transactions, with enough context to identify the user and action. Logs use a consistent format, are protected from tampering, are sent to a central platform and are kept for a defined period. Alerting thresholds and response processes are in place, and log data is encoded to prevent injection. Evidence includes logging standards, sample log records, alert rules, and results of penetration tests showing that attacks were detected.
Common gaps. Common gaps are applications that log only errors, logs stored locally where attackers can delete them, and alerts that nobody reviews. Penetration tests and scans often pass without triggering any alert.