When assessing the design of network monitoring controls, an IS auditor should FIRST review
traffic analysis reports.
The first step in assessing network monitoring controls should be the review of the adequacy of
network documentation, specifically topology diagrams. If this information is not up to date, then
monitoring processes and the ability to diagnose problems will not be effective.