MD001Threat modelling and detection scoping

The derivation of what the program will look for from the harm it is trying to prevent, before any tool is chosen.

Pillar: MD | Monitoring and detection
Sources cited: 4
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD001/PTMandatory	Portugal	Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026	For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report.	For entities in scope, threats are identified and documented as internal or external, natural or human, accidental or intentional.
MD001/GBMandatory	United Kingdom	Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018Secretary of State · read 30 Aug 2026	The closed list of purposes for which an employer may intercept communications on its own system, and the four conditions on doing it, of which one is telling everyone who may use the system.	What may be looked for is a closed list. Interception on the employer’s own system is authorized to establish the existence of facts, to ascertain compliance with regulatory or self-regulatory practices, to ascertain or demonstrate the standards achieved by the people using the system, in the interests of national security, to prevent or detect crime, to investigate or detect the unauthorized use of that or any other telecommunication system, or to secure the effective operation of the system. A purpose outside the list is not authorized by these regulations.
Recommended	European Unionwhere written	ENISA Threat Landscape 2020: Insider ThreatENISA · read 11 Aug 2026	Attack vectors, incident findings, and mitigation at the level of general control categories, in the agency’s only thematic report on the subject.	Scoping starts at the level of control categories rather than of tools, and the only Union report to work from stops there and dates from 2020.
Recommended	Irelandwhere written	Guidance on Cyber Governance for Management Board Members in NIS2 entitiesNational Cyber Security Centre · read 5 Oct 2026	That the management body of an essential or important entity approves the risk management measures, supervises their implementation, follows training and offers it to employees, and is accountable for non-compliance; that insider threats are among the threats a board identifies; and that an incident response plan, a classification procedure, a designated team, and external notification procedures are what response readiness holds.	Insider threats are named among the threat actors and threats an entity identifies against its assets, beside ransomware, supply chain compromise, and state-sponsored actors.