09.ab - Monitoring System Use

This control requires organizations to continuously monitor how their information systems are used, collecting logs of user activity, access attempts and changes to configurations. It mandates regular review of these logs to detect unauthorized or abnormal behavior and to support incident response and compliance reporting.