Does your organization regularly compare actual network traffic flows against established baselines to detect and investigate deviations?

Network traffic baseline comparison is a critical security practice that helps identify unusual patterns that may indicate compromise or misuse. By establishing normal traffic patterns (baselines) and continuously monitoring for deviations, organizations can detect potential security incidents such as data exfiltration, command and control traffic, or lateral movement by attackers.

Evidence of this control could include network traffic analysis reports, screenshots of monitoring dashboards showing baseline comparisons, documented procedures for baseline establishment and deviation investigation, or alert logs showing when traffic anomalies were detected and investigated.