Monitoring activities
Purpose
Monitor networks, systems and applications for anomalous behaviour and act on it to detect potential incidents.
How to meet this control
In short: Monitor networks, systems and applications for anomalous behaviour.
- Step 01Establish a baseline of normal activity covering typical access times, locations, traffic volumes and resource use
- Step 02Configure detection rules and analytics in the SIEM to flag anomalies such as impossible travel, mass downloads, malware signatures and known attack patterns
- Step 03Monitor inbound and outbound network traffic and access to critical systems and configuration files in near real time
- Step 04Route automated alerts to a monitored queue or SOC with defined severity and response steps
- Step 05Enrich monitoring with threat intelligence feeds and tune rules continuously to cut false positives
- Step 06Integrate identity, endpoint and network signals so a single alert reflects the full picture
Tip: Alerting on the logs you collect is what turns logging into a control.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Set monitoring scope and level based on business and security needs and retain records
- ›Monitor inbound and outbound traffic, access to critical systems, config files and resource use
- ›Verify that running code is authorised and untampered
- ›Establish a baseline of normal behaviour by reviewing usage, access times and locations
- ›Configure monitoring to flag anomalies like malware activity and known attack patterns
- ›Use continuous, real-time monitoring tools that handle large data volumes
- ›Configure automated alerts against the baseline, tune to reduce false positives
- ›Enhance monitoring with threat intelligence, machine learning and combined log analysis
Audit evidence to keep
- - Documented baseline of normal behaviour for key systems
- - SIEM detection rules and sample triggered alerts with disposition
- - Alert triage records showing investigation and outcome
- - Threat intelligence feed integration into the monitoring platform
- - Monitoring coverage map across network, endpoint and identity
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.8.16. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.