DE.CM-01 says networks and network services are monitored to find potentially adverse events. In plain terms: someone or something looks at your network traffic and services on a regular basis, knows what normal looks like, and gets alerted when it is not. CSF is voluntary guidance. There is no CSF certification, so you can only show that you meet the outcome.
What good looks like
You can name the networks and services in scope: office, cloud virtual networks, VPN, DNS and any wireless. Logs from them land in one place, and a person owns the alerts. Unknown devices on the network, odd DNS lookups and unusual outbound flows get noticed within a day, not at the next audit.
How to implement it
- Turn on flow logs and DNS query logs in your cloud accounts and at the office router or firewall.
- Send them to a log store you already pay for. A small team does not need a new tool to start.
- Write down a baseline: usual destinations, usual volumes, usual working hours.
- Alert on three things first: new devices joining the network, traffic to countries or hosts you never use, and large outbound transfers.
- Check wireless for rogue access points once a quarter if you have an office.
A worked example
A 30 person company with one office and a cloud network enables flow logs and DNS logging in a single afternoon. The first week of logs shows the normal pattern: a few hundred destinations, peak traffic from nine to six. In week three, a server starts sending DNS queries to a domain with a long random name every sixty seconds. The alert goes to the on call engineer, who isolates the host. It turns out to be malware installed through a pirated plugin. The baseline made the odd pattern easy to see.
Evidence to collect
- A network diagram or list of monitored segments.
- Screenshots or exports of enabled flow and DNS logging settings.
- A sample alert and the ticket showing who handled it.
- The baseline document with a review date.
Common gaps
Logging is on but nobody reads it. Cloud networks are covered while the office is not. Alerts exist with no named owner. The baseline was written once and never updated.
Quick check
Is a firewall alone enough for DE.CM-01?
No. A firewall enforces rules. The outcome is about watching for adverse events, which needs logs that someone reviews or alerts on.
Sources
- NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool and implementation examples: https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters
