Monitoring various aspects of the organization's security-related activities by testing controls, accounting for the number and types of security incidents, and evaluating compliance with policies.
Security-related activities are subject to monitoring.
That's totally different from if I were to say "no comment."