Control A.8.16Monitoring activities
What it means in practice
Networks, systems and applications must be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.
New in the 2022 edition, and it is the active half of A.8.15. Logging records; monitoring looks, and the control requires appropriate actions — someone evaluates what the monitoring surfaces, which means the capability includes people and a process, not only a platform.
What counts as anomalous has to be defined against a baseline, which is why an estate without A.8.9’s configuration baselines produces monitoring that alerts on normality.
The realistic constraint is coverage versus capacity. Monitoring more than the organisation can triage produces a queue, and a queue that is never emptied is indistinguishable from not monitoring — except that it generates a record showing the alert was raised, which is materially worse after an incident.
The detection that matters is tied to the threats identified under A.5.7 and to the paths an attacker would actually take.
How to put this in place
Logs only help if someone notices what is in them. Your ISMS needs defined alerts for unusual activity and a named route to a person who acts on them, or a breach can run for months unseen.
- Confirm the logs you need are collected centrally, then decide what should raise an alert, based on your main threats.
- Build alert rules that cover cloud consoles and identity systems as well as servers.
- Route alerts to named responders or a managed detection service, with cover outside office hours if your risk needs it.
- Record how each alert was handled.
- Review coverage and rule quality periodically, and check that monitoring respects privacy requirements for staff data.
Evidence an auditor usually looks for: alert rules, alert handling records, and the managed service contract and reports where one is used.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Privileged Access Standard
in Privileged Access ManagementIts Framework References list this control. Supported by: Session review cadence (PA-09). - Excel
Break-Glass Account Control Checklist
in Privileged Access ManagementIts Framework References list this control. Supported by: BG-05 and Uses: every sign-in raises an alert to named people, and the alert is itself tested. - Word
Privileged Session Review Record
in Privileged Access ManagementIts Framework References list this control. Supported by: Review schedule and the seven questions. - Excel
Clean-Room Recovery & Rebuild Checklist
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: CG-05, CG-16 and CG-21: monitoring in the recovery environment, the sweep, and watching the staged reconnection.