A library consortium’s SOC currently opens a few firewall logs when someone complains. Leadership wants continuous monitoring with measurable outcomes. What change best establishes that program?
Select an answer to reveal the explanation.
Short Explanation
Spot-checking logs when something feels wrong is like glancing at a smoke detector after you already smell smoke. Continuous monitoring means steady collection, alerts, and metrics you actually track.
Full Explanation
Continuous monitoring is an operations program, not an occasional glance at logs after a complaint. For a library consortium SOC, establishing that program means defining ongoing collection of security-relevant telemetry, analysis and correlation, alerting with actionable thresholds, and periodic review against agreed metrics—detection coverage, mean time to acknowledge, false-positive rates, and control effectiveness. Measurable outcomes let leadership see whether monitoring is improving, not merely whether tickets closed on Friday. Reactive spot checks cannot substitute for that systematic cadence when civic networks face constant scanning and insider misuse risks.
Keeping ad hoc log glances and measuring success only by ticket volume rewards busywork rather than detection quality or coverage. Deleting historical logs weekly destroys forensic and trend value and forces a myopic live-only view that misses slow attacks. Outsourcing all monitoring with no internal metrics or ownership of alerting criteria abandons accountability; even when a managed service helps, the municipality must still define what “good” looks like and retain oversight of thresholds and escalation.
Exam caveat: continuous monitoring relates to ongoing risk and control assessment, often tied to metrics and thresholds rather than pure tool ownership. Do not confuse continuous monitoring with continuous authorization jargon alone—operations still need collection, analysis, alerting, and review loops. Retention policies must balance privacy, legal holds, and investigative need.
Operational check: publish a monitoring metrics dashboard for consortium leadership, map each critical system to log sources and alert owners, set retention that supports investigations, and schedule recurring threshold reviews so alerts stay tuned to actual library and municipal risk.