Domain: Information
Question:
An organization is adopting NIST CSF 2.0 as an outcome-based (non-prescriptive) way to justify detection coverage decisions across three sub-environments: (1) a segmented regulated enclave containing the organization's "crown jewels" with 24/7 SOCaaS monitoring, (2) a standard corporate environment, and (3) guest/BYOD endpoints that are not uniformly managed but can still authenticate to enterprise resources. The security engineering team is under executive scrutiny after peer breaches and is being asked to make a defensible claim that their detection program meets Detect outcomes--specifically DE.CM (Continuous Monitoring) and DE.AE (Adverse Event Analysis)--without over-collecting personal data or assuming they must provide full real-time response everywhere. Given that CSF 2.0 describes what outcomes to achieve rather than prescribing specific tooling or maturity targets, how should the organization scope monitoring for corporate and BYOD endpoints that access organizational systems or data so it avoids "regulated-only" blind spots? In your reasoning, explicitly distinguish between (a) continuous visibility (minimum logging/telemetry collection and review sufficient to detect, analyze, correlate, and reconstruct timelines across environments) and (b) continuous response (24/7 human or automated response SLAs), and explain why satisfying DE.CM/DE.AE does not automatically imply full-time response coverage for every environment. Finally, describe what formal policy/consent artifacts (e.g., BYOD policy, SLAs/MOUs) and what monitoring emphasis (identity/authentication events, access to corporate apps, security-relevant actions vs. full device surveillance) would support a risk-based approach now--and what incremental capabilities (e.g., EDR, cloud access controls, centralized correlation in the SOC) could be layered in as maturity increases.

Expected points in a correct answer:
States that monitoring coverage should extend to the corporate and BYOD environment where devices access organizational systems or data.
Identifies blind spots created by only monitoring crown jewels
Identifies need for BYOD policy to manage user consent
States that monitoring coverage should extend to the corporate environment where devices access organizational systems or data.
Identifies DE.CM as justifiable security function
Identifies DE.AE as justifiable security function
States alignment with DE.CM and DE.AE necessary for corporate environment
States alignment with DE.CM and DE.AE necessary for BYOD devices
States logs should be collected
States logs should be reviewed
Distinguishes between continuous visibility (logging/telemetry collection and review) and continuous response (full real-time/24/7 response)
Identifies timelines building as positive security outcome from extended logging
Identifies activity correlation as positive security outcome from extended logging
Identifies incident investigation as positive security outcome from extended logging
Identifies identity activity as security relevant action.
Identifies authentication events as security relevant action.
Identifies access to corporate applications as security relevant action.
Identifies EDR as potential future state security goal
Identifies cloud access security controls as potential future state security goal
Identifies centralized log correlation within the SOC as a potential future state security goal.
States that any endpoint that can authenticate to organizational resources becomes part of the organization's attack surface.
States entire attack surface should be included in monitoring scope
States that meeting DE.CM/DE.AE does not necessarily mean full real-time response for every environment
States that without visibility into corporate/BYOD environments, it becomes difficult to determine where an incident originated or how far it spread
States that monitoring emphasis should be on security-relevant actions rather than full device surveillance
States that enhanced capabilities strengthen early detection and reduce dwell time
Acknowledges that it is appropriate to prioritize the regulated environment containing crown jewels
States that formal policies should define what activity can be monitored