What the term leaves open
A monitoring service label does not establish what is observed. Periodic checks of public configuration differ fundamentally from ongoing analysis of security events. Data sources, timing and responsibilities must be visible when selecting a service.
Configuration change or an ongoing event?
A repeat external assessment may show that a service is now reachable in a different way. It does not automatically reconstruct every event since the previous assessment. The NCSC’s logging and monitoring guidance describes active analysis of logs to identify attack indicators or unusual behaviour.
A notification is not a response
Our recommendation is to state separately when checks run, when notifications are produced and who handles them. A quarterly report and a continuously staffed operations centre serve different purposes. A promised notification time is also not a promised remediation time.
Five questions for the assessment plan
Which systems are included? Which characteristics or events are examined? How often and with what delay? Who receives which notification? What happens when a check fails or a finding is confirmed? Agree these in writing before treating monitoring as comprehensive coverage.
Example: a changed web configuration
A weekly check finds a new configuration on Friday. That comparison alone does not establish that the change happened on Friday. A useful report distinguishes the previous successful baseline, the current assessment time and the documented change. This is a methodological example, not a real client finding.
Complementary services
Repeat assessments and event-based monitoring can complement one another. One records the agreed baseline and changes; the other analyses suitable event data. A clear service description identifies its role rather than hiding both behind an undefined promise.
Related assessment
Related reading
Primary sources checked on 26.09.2026.
Sources and limitations are identified in the article.