ASD Essentials IT.DET-05.1 Periodically Review Detection Coverage for Gaps as Assets, Services and Architecture Change
What it says
Review detection coverage periodically to identify gaps arising from new assets, services or architectural changes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReviews security monitoring coverage regularly to find blind spots left by new systems, new services or changes to system design.
Detection coverage is what security monitoring can see: which systems send logs to the security team and which have alert rules. New systems, new services and design changes, such as moving to the cloud, can leave blind spots. To meet this, review coverage on a set cycle and check each new system and service as it goes live. Fix the gaps you find within set timeframes based on risk.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Visibility and response: a capability domain, which ASD applies across all phases from the start.
Why it matters
Without these reviews, new systems and services can go live unwatched, and design changes can move activity out of sight. Attackers can then work in these blind spots unseen. Unfixed gaps also leave responders without the records they need.
How to implement
The head of security should name a coverage owner and approve a review procedure.
It covers all on-site, cloud and online software systems, and sets a risk-based review cycle, fix timeframes and triggers for extra reviews.
Detection engineers should keep a coverage map, such as a spreadsheet of each system, its expected logs and its alert rules.
Each review compares the map with asset lists and scans to find missing items, and confirms expected logs arrive.
Change managers and system owners should add a coverage step to go-live approval for new systems and services, including new cloud accounts.
Confirm logs are collected and decide which alert rules apply or are needed.
The change approval board should send design changes, such as a cloud move or a new remote access system, to security operations.
Detection engineers then check that logs and alert rules will still see the activity.
The coverage owner should log each gap with an owner and a due date set by its risk.
Escalate overdue gaps to the head of security, and close a gap only when a test event raises the expected alert.
Keep it running
The security operations or detection engineering lead usually owns coverage. Add a coverage check to go-live and change approvals, and let the scheduled review catch what slips through. This action applies organisation-wide, in every priority phase. Monitoring grows as systems come into scope, so each review should include anything added since the last one. Chase overdue gaps at the regular security operations or governance meeting.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the coverage review procedure, its set cycle and the two latest review reports.
Look at
Whether a review was done within the cycle, or no cycle is set.
Good evidence
Reviews finish within the set cycle, and the next one is booked.
- Check 2 of 5What an auditor asks for
Ask for
Request the latest review findings and the systems and services added since the previous review.
Look at
Whether the review missed recent additions, or marked items covered whose logs never arrive.
Good evidence
The review covered every recent addition, and its findings match the logs actually received.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the go-live coverage step and completed checks for a sample of new systems.
Look at
Whether new items went live unchecked, or logs were checked but alert rules never considered.
Good evidence
Each new system and service has a recorded check of its logs and alert rules.
- Check 4 of 5What an auditor asks for
Ask for
Ask for recent design changes and the coverage check made for each.
Look at
Whether major changes had no check, or rules still watch systems the activity has moved away from.
Good evidence
Each major change was checked, and any gaps it created are in the gap register.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the gap register, the fix timeframes and proof of closure for sampled gaps.
Look at
Whether planned fixes are overdue, or gaps were closed without proof that alerts now fire.
Good evidence
Gaps are fixed within the risk-based timeframes and tested before closure.
ASD indicators of good practice (7)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1No review of detection coverage has been conducted within the period defined by the organisation.
- NE-2No process exists to assess new assets and services for log coverage or detection applicability.
Partially effective(2)
- PE-1A review of detection coverage has been conducted but does not cover all recently deployed assets or services.
- PE-2Detection gaps have been identified and remediation is planned, but remediation has not been executed within timeframes defined by the organisation.
Fully effective(3)
- FE-1A detection coverage review has been completed within the cycle defined by the organisation.
- FE-2New assets and services are assessed for log coverage and detection rule applicability.
- FE-3Identified detection gaps are remediated within risk-based timeframes defined by the organisation.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.1, Automated asset discovery at least fortnightly, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control supports A.8.16.
IT.DET-05.1 requires detection coverage to be reviewed periodically to identify gaps arising from new assets, services or architectural changes. This keeps the monitoring of networks, systems and applications for anomalous behaviour required by Annex A 8.16 complete as the environment changes. IT.DET-05.1 is a periodic review activity, while Annex A 8.16 covers the monitoring itself and the evaluation of potential incidents.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-PA-ML1.1.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; E8-PA-ML1.1 requires automated asset discovery at least fortnightly for vulnerability scanning, which can surface new assets whose detection coverage those reviews should check.
This control partially overlaps E8-PO-ML1.1.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; E8-PO-ML1.1 requires automated asset discovery at least fortnightly for vulnerability scanning, which can also surface new assets for that coverage review.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-0120.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; ISM-0120 requires cyber security personnel to have sufficient tools to detect events and identify incidents, and those reviews help keep them sufficient.
- ISM-1526System Owners Continuously Monitor Security and Manage Threats, Risks and ControlsPartially overlaps
This control partially overlaps ISM-1526.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; ISM-1526 requires system owners to continuously monitor each system's security and manage its threats, risks and controls, a broader duty those reviews support.
This control partially overlaps ISM-1617.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; ISM-1617 requires the CISO to regularly review and update the cyber security program to keep it relevant to cyber threats, a broader program-level review.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.