Key takeaways
- Monitor networks and systems for unusual behaviour and act on it.
- Monitoring turns logs and signals into timely detection of attacks.
- Start here: define what abnormal looks like for networks, systems and applications.
Purpose
Monitor networks and systems for unusual behaviour and act on it.
Requirement
Requirement summaryNetworks, systems and applications shall be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.
Why it matters
Monitoring turns logs and signals into timely detection of attacks.
How to implement
- Define what abnormal looks like for networks, systems and applications.
- Set alerts and assign who responds.
- Review alerts promptly and record outcomes.
- Tune rules regularly.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.16. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your monitoring process: what is watched and what happens when something unusual happens.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.16 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Alert records and the tickets showing they were investigated.
- A screenshot or export of alert settings showing thresholds and who gets notified.
- Reports of monitoring trends reviewed by IT.
Things you should be able to show or explain
- Be able to show who receives alerts and how quickly they respond.
How much to show: A handful of alerts from the last year.
Common mistakes
- Alerts ignored.
- Key systems not monitored.
- So many alerts that real ones are missed.
- Nobody on call outside business hours.
- Tip: Tune alerts so the team actually reads them.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.16 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.16?
Be ready to explain how the control works in your organisation and to provide things like: Your monitoring process: what is watched and what happens when something unusual happens…