DET-05 · Detect

Detection capability efficacy

Cyber security event detection capabilities are regularly evaluated for effectiveness and continuously refined, including by using current strategic and sector-specific cyber threat intelligence, to improve the detection of cyber security events.

Enterprise IT actions

• IT.DET-05.1

  Review detection coverage periodically to identify gaps arising from new assets, services or architectural changes.

  • Every phaseVisibility and response
  ASD’s indicators

  Not effective

  • No review of detection coverage has been conducted within the period defined by the organisation.
  • No process exists to assess new assets and services for log coverage or detection applicability.

  Partially effective

  • A review of detection coverage has been conducted but does not cover all recently deployed assets or services.
  • Detection gaps have been identified and remediation is planned, but remediation has not been executed within timeframes defined by the organisation.

  Fully effective

  • A detection coverage review has been completed within the cycle defined by the organisation.
  • New assets and services are assessed for log coverage and detection rule applicability.
  • Identified detection gaps are remediated within risk-based timeframes defined by the organisation.
  Related frameworks

  ISM

  ISM-0120, ISM-1526, ISM-1617

  NIST CSF 2.0

  DE.CM-09, ID.IM-02, ID.IM-03, GV.OV-03

  NIST SP 800-171r3

  03.12.03, 03.03.01, 03.14.06

  AESCSF v2

  RESPONSE-1e, SITUATION-2i, SITUATION-2c

  Essential Eight

  Patch applications, Patch operating systems

  Rate this action in the Navigator →

Cloud actions

• Action 1

  Review detection coverage periodically to identify gaps arising from new cloud services, integrations or architectural changes

  • Every phaseVisibility and response
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Detect principles

• DET-01Centralised event logging
• DET-02Cyber security event detection
• DET-03Cyber security incident identification
• DET-04Baseline high-risk access activities

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.