GPG13 is often treated as a compliance checklist, but its intent is operational: ensuring organisations can detect, respond to and learn from cyber attacks.