Has your organization established and maintained a baseline of network operations and expected data flows for users and systems?

This question assesses whether your organization has documented normal network behavior patterns and data flows, which is essential for detecting anomalies that could indicate security incidents. A network baseline defines what constitutes 'normal' traffic, connections, and system behaviors across your environment, enabling more effective identification of potential security events when deviations occur.As evidence, you could provide network baseline documentation that includes network topology diagrams, expected data flow mappings between systems, normal traffic volume patterns, authorized communication protocols, and standard user activity profiles. This documentation should be regularly reviewed and updated to reflect changes in your environment.