Clause 9.1.a

The organization should decide what to monitor and measure. Use measures that will warn employees if the system is under attack or about to be compromised somehow.