How do I answer the cyber insurance questions about network monitoring and security logs?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Do you use a network monitoring solution to alert your organization to suspicious activity or malicious behaviour on your network?

Please provide details on whether you have a security operations centre (SOC) that is responsible for event monitoring and detection, vulnerability management and incident response.

Systematic storage and monitoring of network and security logs

What does it mean for a small firm?

These are about activity inside your network: who signed in, what moved, what was blocked. Most small firms buy this from a provider or do not have it.

How do I answer it truthfully?

If nobody reviews alerts, the answer is No even if logs exist. If a provider watches, give its name and the hours it covers.

Can an outside reading check this?

An outside reading does not watch traffic inside your network. Nothing inside your network, your devices or your accounts can be seen from outside, so this cannot be checked that way. Only your own settings and records can show it.

Which questions sit next to this one?

• EDR
• Firewalls