Normal network traffic is described and the description maintained to detect anomalies. The description should be updated:
The organization maintains documentation of interfaces and other connections between data system and the data transmission methods used in the interfaces.
The documentation concerning the interfaces shall be reviewed regularly and after significant changes to data systems.