MD021Detection coverage assessment

The holding of two lists against each other: what the program declared it has to be able to detect, and what its instruments actually deliver today, given where the agents are installed, which systems send their records, and which rules are live. Its output is a named gap. Without it coverage is assumed rather than known, and it decays quietly, since a source that stops sending announces nothing.

Pillar: MD | Monitoring and detection
Sources cited: 4
Added: 30 AUGUST 2026
Updated: 1 SEPTEMBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD021/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, two lists are required: the assets that are to be logged, derived from the risk assessment, and the assets that are actually being logged. The second, and the procedures behind it, are reviewed and where appropriate updated at regular intervals and after a significant incident. That the two are to be held against each other is not stated.
MD021/ESMandatory	Spain	Real Decreto 311/2022, Esquema Nacional de SeguridadGobierno de España · read 29 Aug 2026	The security measures a Spanish public sector body has to apply, graded by category, among them the concurrence of two people on critical tasks so that no single authorized individual can abuse their rights, an access control on the activity records themselves, and the recording of evidence where an incident may end in disciplinary action.	Analyzing an incident is what reopens the question of what is audited: the determination of the auditable events is reviewed as a consequence of the analysis.
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	The detection systems in place and the measures taken should be examined in regular audits for whether they are still current and still effective. The metrics that arise when a security relevant event is taken in, reported, and escalated are evaluated, the results of the audit are documented so that they can be followed, and they are compared against the state the systems are supposed to be in. A departure from it is pursued.
Recommended	Norwaywhere written	NSMs grunnprinsipper for IKT-sikkerhet 2.1Nasjonal sikkerhetsmyndighet · read 29 Aug 2026	A set of principles for securing information systems, with the monitoring ones carrying what the collected data may be used for, what employees are to be told about it, and the requirement to verify that the collection is working.	It is verified that the collection works as it was meant to. The log settings are checked to see that they function and that what was to be gathered is being gathered, every system that regularly stores security relevant data is given enough space that nothing needed is lost, and a standardized format is used so the data can be read by a third party’s analysis tool.