Normal asset operation is not sufficiently baselined to support the identification of abnormal asset operation
Context and Guidance: Logging data generated by assets (such as networks, systems, and applications) can become more useful over time, as normal patterns become apparent within security monitoring solutions.
Understanding normal asset operation is critical to identifying abnormal asset operation.
Baselines may be established for individual assets (e.g. a field device) or for a collection of interconnected assets.