[{"Identifier": "CYB.090.010","Activity": "Network, System and Data Monitoring","Description": "Continuously perform security monitoring on all networks, systems, applications and data in the organization and external environments (including cloud and websites) and other trusted sources of information owned by the organization in order to detect suspicious activity across the enterprise."},{"Identifier": "CYB.090.020","Activity": "Penetration Testing","Description": "Conduct penetration testing of organizational networks and systems to make the organization aware of weaknesses that can be similarly identified or exploited."},{"Identifier": "CYB.090.030","Activity": "Vulnerability Assessment","Description": "Conduct proactive vulnerability assessments on organizational networks and systems (including the SOC) and address findings in a timely manner in order to prevent or minimize damage to the organization."}]