Detection rules are consistently developed, tested and refined using threat intelligence and past incidents
This process control develops and refines detection rules using threat intelligence and past incidents, the direct downstream use of the intelligence A.5.7 requires.
Developing, testing and refining detection rules from threat intelligence and past incidents keeps A.8.16's monitoring capability current against real threats.