The Observe phase requires every organization to monitor its network continuously, with no option for less frequent monitoring.

### Why this is right The material says organizations should determine the frequency and intensity of monitoring. It gives continuous, around-the-clock monitoring as an option, while also allowing a more ad hoc approach. ### The concept Monitoring supports detection, but its schedule is a planning decision. Continuous monitoring may be appropriate for some environments, while other organizations may monitor less frequently. Whatever approach is chosen, observations should be analyzed and documented so responders can decide whether an incident response plan needs activation. The source does not prescribe one schedule for every organization. ### The other options - **True**: This would incorrectly turn one possible monitoring approach into a universal requirement. ### Terms - **Ad hoc monitoring**: Monitoring carried out as needed or at selected times rather than continuously. ### Watch out A recommendation to consider continuous monitoring is not the same as a rule that every organization must use it. ### Remember Choose monitoring frequency and intensity to suit the organization; document and assess what monitoring finds.