Does your organization employ automated tools to detect indicators of compromise and evidence of persistence across your systems?

Automated tools like endpoint detection and response (EDR), security information and event management (SIEM) systems, or threat hunting platforms should continuously monitor your environment for signs of malicious activity. These tools can identify unusual behaviors, known malware signatures, unauthorized access attempts, and persistent threats that may have established a foothold in your systems. Evidence of fulfillment could include documentation of deployed security tools with screenshots of dashboards showing active monitoring, reports generated by these tools showing scan results, or a written procedure detailing how and when automated scans are performed across your environment.