ISO 27001 A.8.16: Make monitoring lead to timely assessment

What A.8.16 requires in practice

A.8.16 requires networks, systems and applications to be monitored for anomalous behaviour, and appropriate action to be taken to evaluate potential information security incidents. The control is about noticing the unusual and then deciding what it means. Monitoring that produces alerts with nobody to assess them does not complete the control.

In practice the organisation decides what to watch, such as sign-ins, network traffic, application errors and changes to sensitive data, and what normal looks like for each. It sets up the means to detect departures from normal, assigns people to evaluate them and gives those people enough context and authority to decide whether an incident exists. Evaluation links onward to incident handling.

Outputs include defined monitoring coverage, a working detection and alert route and records of evaluations and decisions. The control does not require a particular tool or a round-the-clock team. Sterling's teams often begin with a short list of the events that would matter most, which is a method and not a stated obligation.

Choose what needs attention

Define monitoring scope using important information, services and credible concerns. A critical customer application may need different coverage from a low-impact internal utility. Understand which systems provide the relevant signals and where the organisation has limited visibility, especially when a provider operates part of the service.

Connect the design with logging. Recorded events are an important input, but monitoring also requires interpretation and an appropriate response. Describe the purpose of each meaningful alert or review activity so it is clear which concern it addresses and what an analyst should investigate.

Understand expected behaviour before judging deviations

Establish a useful understanding of normal operation. Working hours, maintenance windows, seasonal demand and legitimate administrative activity can affect interpretation. A deviation is a reason to assess, not automatic proof of compromise. Conversely, activity within a broad numerical threshold can still require attention when its context is unusual.

Review assumptions when the business changes. New locations, customer workflows or service architectures can make old rules noisy or ineffective. Keep a controlled record of significant tuning decisions so reducing false positives does not accidentally remove a needed detection capability.

Why security monitoring matters to the business

The time between a compromise and its discovery largely decides how much damage follows. Monitoring shortens that time, which limits data exposure, recovery cost and the number of customers affected. It also lets the organisation answer a client or regulator who asks when it first knew. Unfocused monitoring can be as unhelpful as none: a flood of alerts trains people to ignore them, and an alert that reaches nobody is wasted effort. Proportionate monitoring focuses attention on what matters, supports accountable decisions and shows leaders that detection is a managed capability. Auditors tend to ask for a recent case, so evidence that alerts are assessed and acted on carries real weight.

How to implement A.8.16

Decide which events matter most, make sure they reach a person who can judge them, and check that judgement leads somewhere. Detection is only valuable when followed by a decision.

1. Identify the networks, systems and applications whose misuse would hurt most, and the events that would signal trouble.
2. Establish what normal looks like, including shift patterns, seasonal peaks and routine maintenance, so deviations stand out.
3. Configure detection and decide where alerts go, including cover for absences and out-of-hours periods that the business considers important.
4. Give responders the context and authority to investigate, isolate or escalate without waiting for a long approval chain.
5. Record each evaluation, including cases judged not to be incidents and the reasons.
6. Link confirmed events to your incident process so nothing is lost at the handover.
7. Review coverage and the quality of decisions regularly, including a sample of alerts closed as harmless, and tune alerts that create noise so important ones are not buried.

Evidence an auditor expects for A.8.16

An auditor will look for monitoring that is defined, running and followed by decisions. Typical evidence includes:

• a description of what is monitored and the reasoning for that coverage;
• settings for alerts and the route by which they reach responders;
• records of recent alerts with the evaluation and outcome for each, including those closed as harmless;
• observation of the monitoring console or alert queue alongside the person who uses it;
• an interview with a responder about a recent case and how the decision was made.

The most persuasive evidence is a real alert followed through to an outcome. A list of configured rules shows intent but not operation.

Common nonconformities with A.8.16

Monitoring findings usually involve alerts that go unused.

• Alerts sent to a shared mailbox or to a person who has left, so nobody evaluates them.
• No definition of normal behaviour, so unusual activity cannot be recognised.
• Monitoring covers servers but not cloud services, applications or remote access.
• Alert volume so high that staff routinely ignore them, with no tuning and no one owning the problem.
• Evaluations not recorded, so the organisation cannot show what was decided or why, and repeated patterns are never noticed.

Illustrative BPO example: a new shift changes the pattern

Illustrative software example: an alert that nobody receives

A hypothetical software provider configures an alert for a relevant administrative event. The monitoring platform records the signal correctly, but notification goes to a former team's mailbox. Reports show the rule as enabled, so management assumes that the response process is operating.

An authorised exercise follows the alert through notification, acknowledgement, assessment and escalation. The provider corrects the ownership and establishes a review trigger when teams or suppliers change. The test demonstrates the human handoff as well as technical detection; the enabled rule alone could not establish that someone would assess the event.

Give responders enough authority and context

Specify who assesses an alert, what supporting information is available and when escalation is necessary. Response expectations should reflect the importance and operating hours of the service. Where a supplier monitors on the organisation's behalf, clarify responsibilities and how information reaches the people who can authorise business action.

Link significant findings with assessment of security events and incident response. The monitoring team should not be forced to make consequential operational decisions without an agreed route. Equally, a report should not wait unexamined because everyone assumes another party owns it.

Evaluate coverage and the quality of decisions

Useful evidence includes defined coverage, rule purposes, relevant baseline assumptions, review records, response arrangements and test results. These are practical implementation methods rather than a required set of separate documents. Establish appropriate retention and access for monitoring information, taking applicable legal and privacy requirements into account.

Safe tests should establish whether a relevant signal is available, recognised and assessed. Test missing data too: a quiet dashboard may indicate normal operation, a disconnected source or a failed integration. Record limitations where a test simulates a condition rather than reproducing the full production path.

Common failures include unmanaged false positives, permanently suppressed rules and performance measures based only on alert volume. Through ISMS evaluation, examine unhandled alerts, coverage gaps, decision quality and recurring issues. Improvement might involve better source data, clearer ownership or a more suitable rule, rather than simply adding more technology.