DE.CM-01 — Network monitoring

Networks and network services are monitored to find potentially adverse events.

Also written as DE-CM-01, DE.CM-1, CSF 2.0 DE.CM-01, NIST CSF DE.CM.

Written by Jett N. · Last reviewed 22 July 2026

What NIST CSF DE.CM-01 means

DE.CM-01 is one of 11 subcategories in the Detect (DE) function, under the Continuous Monitoring category (DE.CM). The Core states: “Networks and network services are monitored to find potentially adverse events.” Detect outcomes are assessed on coverage and timeliness together — a monitoring capability that only watches part of the environment, or that nobody reviews, does not achieve the outcome regardless of the tooling in place.

Evidence that supports DE.CM-01

To demonstrate this outcome in an assessment or audit, gather artefacts such as:

How to implement DE.CM-01

1. Establish what normal looks like firstAdverse events are deviations, which presupposes a baseline. Traffic profiles, expected egress destinations and normal service-to-service communication give detection something to measure against. Without a baseline you get volume rather than signal.
2. Instrument east-west, not only north-southPerimeter monitoring misses lateral movement, which is where an intrusion becomes a breach. Flow logs between internal segments and between cloud workloads are what surface that, and they are commonly missing.
3. Monitor encrypted traffic by metadataMost traffic is encrypted and inspecting it is often neither practical nor lawful. Destination, volume, timing and certificate metadata still yield strong signals — beaconing and exfiltration patterns are visible without decryption.
4. Route alerts to a defined responderThe outcome is about finding adverse events, which implies someone finds them. Whether that is a SOC, an MSSP or a named engineer on a rota, the responsibility and schedule need to be recorded.
5. Document coverage and the gaps you acceptedA network monitoring coverage map — segments, cloud VPCs, remote workers, third-party connections — with declared gaps and rationale is the artefact that makes this outcome assessable.

Common assessment findings for DE.CM-01

What actually gets raised against DE.CM-01, in rough order of how often it comes up:

• Perimeter monitoring only, with no visibility of internal or cloud-to-cloud traffic.
• Remote workers outside the monitored network entirely, which for a distributed organisation is most of the traffic.
• Alerts generated with no defined owner and no triage record.
• Monitoring deployed at one point in time with coverage never re-checked against a changed architecture.

Assessing DE.CM-01 in a profile

DE.CM-01 is assessed on coverage and timeliness together. Partial coverage that is well understood and declared scores better in practice than broad coverage nobody can describe, because the Current Profile is supposed to reflect reality rather than intent.

ISO 27001 mapping

DE.CM-01 corresponds to the following ISO 27001:2022 Annex A control(s): A.8.16, A.8.20. Evidence collected for one framework typically supports the other.

Other Continuous Monitoring subcategories

All 11 Detect subcategories →