Control A.8.16Monitoring activities
Networks, systems and applications must be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.
New in the 2022 edition, and it is the active half of A.8.15. Logging records; monitoring looks, and the control requires appropriate actions — someone evaluates what the monitoring surfaces, which means the capability includes people and a process, not only a platform.
What counts as anomalous has to be defined against a baseline, which is why an estate without A.8.9’s configuration baselines produces monitoring that alerts on normality.
The realistic constraint is coverage versus capacity. Monitoring more than the organisation can triage produces a queue, and a queue that is never emptied is indistinguishable from not monitoring — except that it generates a record showing the alert was raised, which is materially worse after an incident.
The detection that matters is tied to the threats identified under A.5.7 and to the paths an attacker would actually take.
How to put this in place
Logs only help if someone notices what is in them. Your ISMS needs defined alerts for unusual activity and a named route to a person who acts on them, or a breach can run for months unseen.
- Confirm the logs you need are collected centrally, then decide what should raise an alert, based on your main threats.
- Build alert rules that cover cloud consoles and identity systems as well as servers.
- Route alerts to named responders or a managed detection service, with cover outside office hours if your risk needs it.
- Record how each alert was handled.
- Review coverage and rule quality periodically, and check that monitoring respects privacy requirements for staff data.
Evidence an auditor usually looks for: alert rules, alert handling records, and the managed service contract and reports where one is used.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.