ISO 27001:2022 8.16: Monitoring activities

What else in your programme already covers this

This control maps to 231 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 31 controls

AC-17(1) Monitoring and Control
AC-2(12) Account Monitoring for Atypical Usage
AC-2(7) Privileged User Accounts
AU-6 Audit Record Review, Analysis, and Reporting
AU-6(1) Automated Process Integration
AU-6(3) Correlate Audit Record Repositories
AU-7 Audit Record Reduction and Report Generation
AU-7(1) Automatic Processing
CA-7 Continuous Monitoring
CA-8(2) Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
CM-12(1) Information Location | Automated Tools to Support Information Location. Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational
CM-8(3) Automated Unauthorized Component Detection
IR-1 Policy and Procedures
IR-4(1) Automated Incident Handling Processes
IR-5 Incident Monitoring
IR-6(1) Automated Reporting
IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support. Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms]
MA-4 Nonlocal Maintenance
SA-1 Policy and Procedures
SA-2 Allocation of Resources
SC-7 Boundary Protection
SI-4 System Monitoring
SI-4(1) System Monitoring | System-wide Intrusion Detection System. Connect and configure individual intrusion detection tools into a system-wide intrusion detection system
SI-4(16) System Monitoring | Correlate Monitoring Information. Correlate information from monitoring tools and mechanisms employed throughout the system
SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration. Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points
SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis
SI-4(23) System Monitoring | Host-based Devices. Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms]
SI-4(5) System-Generated Alerts
SI-5 Security Alerts, Advisories, and Directives
SI-7(7) Integration of Detection and Response
SR-10 Inspection of Systems or Components (SR-10)

FedRAMP Moderate · 31 controls

AC-17(1) Monitoring and Control
AC-2(12) Account Monitoring for Atypical Usage
AC-2(7) Privileged User Accounts
AU-6 Audit Record Review, Analysis, and Reporting
AU-6(1) Automated Process Integration
AU-6(3) Correlate Audit Record Repositories
AU-7 Audit Record Reduction and Report Generation
AU-7(1) Automatic Processing
CA-7 Continuous Monitoring
CA-8(2) Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
CM-12(1) Information Location | Automated Tools to Support Information Location. Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational
CM-8(3) Automated Unauthorized Component Detection
IR-1 Policy and Procedures
IR-4(1) Automated Incident Handling Processes
IR-5 Incident Monitoring
IR-6(1) Automated Reporting
IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support. Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms]
MA-4 Nonlocal Maintenance
SA-1 Policy and Procedures
SA-2 Allocation of Resources
SC-7 Boundary Protection
SI-4 System Monitoring
SI-4(1) System Monitoring | System-wide Intrusion Detection System. Connect and configure individual intrusion detection tools into a system-wide intrusion detection system
SI-4(16) System Monitoring | Correlate Monitoring Information. Correlate information from monitoring tools and mechanisms employed throughout the system
SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration. Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points
SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis
SI-4(23) System Monitoring | Host-based Devices. Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms]
SI-4(5) System-Generated Alerts
SI-5 Security Alerts, Advisories, and Directives
SI-7(7) Integration of Detection and Response
SR-10 Inspection of Systems or Components (SR-10)

NIST SP 800-53 Rev 5 · 19 controls

NIST800-AC-23 Data Mining Protection. Employ [organization-defined] for [organization-defined] to detect and protect against unauthorized data mining
NIST800-AU-14 Session Audit. Provide and implement the capability for [organization-defined] to [organization-defined] the content of a user session under [organization-defined] ; and Develop, integrate, and use session auditing activities in consultation with legal counsel and
NIST800-AU-6 Audit record review, analysis, and reporting
NIST800-AU-7 Audit record reduction and report generation
NIST800-CA-1 Policy and procedures for assessment, authorization, and monitoring
NIST800-CA-7 Continuous monitoring
NIST800-IR-5 Incident monitoring
NIST800-PM-14 Testing, Training, and Monitoring. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: Are developed and maintained; and Continue to be
NIST800-PM-31 Continuous Monitoring Strategy. Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following organization-wide metrics to be monitored: [organization-defined]; Establishing [organization-defined] and [organization-defined] for control effectiveness; Ongoing monitoring
NIST800-PM-32 Purposing. Analyze [organization-defined] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose
NIST800-PM-6 Measures of Performance. Develop, monitor, and report on the results of information security and privacy measures of performance
NIST800-RA-10 Threat hunting
NIST800-SC-42 Sensor Capability and Data. Prohibit [organization-defined] ; and Provide an explicit indication of sensor use to [organization-defined]
NIST800-SI-4 System monitoring
NIST800-SI-5 Security alerts, advisories, and directives
NIST800-SI-6 Security and Privacy Function Verification. Verify the correct operation of [organization-defined]; Perform the verification of the functions specified in SI-6a [organization-defined]; Alert [organization-defined] to failed security and privacy verification tests; and [organization-defined] when anomalies
NIST800-SR-10 Inspection of systems or components
SP800-53-CA Assessment, Authorization, and Monitoring Family
SP800-53-SI System and Information Integrity Family

NIST SP 800-53 Revision 5.1 HIGH · 19 controls

AC-17(1) Monitoring and Control
AC-2(12) Account Monitoring for Atypical Usage
AU-6 Audit Record Review, Analysis, and Reporting
AU-6(1) Automated Process Integration
AU-6(3) Correlate Audit Record Repositories
AU-7 Audit Record Reduction and Report Generation
AU-7(1) Automatic Processing
CA-7 Continuous Monitoring
CM-12(1) Information Location | Automated Tools to Support Information Location. Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational
CM-8(3) Automated Unauthorized Component Detection
IR-1 Policy and Procedures
IR-5 Incident Monitoring
MA-4 Nonlocal Maintenance
SA-1 Policy and Procedures
SA-2 Allocation of Resources
SC-7 Boundary Protection
SI-4 System Monitoring
SI-5 Security Alerts, Advisories, and Directives
SR-10 Inspection of Systems or Components (SR-10)

NIST SP 800-53 Rev 5 MODERATE · 18 controls

AC-17(1) Monitoring and Control
AU-6 Audit Record Review, Analysis, and Reporting
AU-6(1) Automated Process Integration
AU-6(3) Correlate Audit Record Repositories
AU-7 Audit Record Reduction and Report Generation
AU-7(1) Automatic Processing
CA-7 Continuous Monitoring
CM-12(1) Information Location | Automated Tools to Support Information Location. Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational
CM-8(3) Automated Unauthorized Component Detection
IR-1 Policy and Procedures
IR-5 Incident Monitoring
MA-4 Nonlocal Maintenance
SA-1 Policy and Procedures
SA-2 Allocation of Resources
SC-7 Boundary Protection
SI-4 System Monitoring
SI-5 Security Alerts, Advisories, and Directives
SR-10 Inspection of Systems or Components (SR-10)

PCI DSS 4.0 · 16 controls

10.4.1 Daily log review for critical systems
10.4.1.1 Automated mechanisms for log review
10.4.2 Periodic review of other system component logs
10.4.3 Exceptions and anomalies addressed
10.7.1 Critical security control failure detection (SP)
10.7.2 Critical security control failure detection (all entities)
11.4.5 Segmentation testing
11.4.6 Segmentation testing (service providers) every 6 months
11.5.1 IDS/IPS in place
11.5.1.1 Covert malware channel detection (SP)
11.6.1 Payment page change and tamper detection
12.10.5 IRP includes monitoring and response to security control alerts
12.4.2.1 Documentation of quarterly reviews (SP)
6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following: • Is installed in front of public-facing web applications and is configured
9.2.3 Physical access to networking and telecommunications hardware restricted
6.4.3 All payment page scripts that are loaded and executed in the consumer's browser are managed as follows: • A method is implemented to confirm that each script is authorized. • A method is implemented

CMMC 2.0 · 11 controls

AC.L2-3.1.8 Unsuccessful Logon Attempts
AU.L2-3.3.1 System Auditing
AU.L2-3.3.3 Event Review
AU.L2-3.3.4 Audit Failure Alerting
AU.L2-3.3.5 Audit Correlation
AU.L2-3.3.6 Reduction & Reporting
AU.L2-3.3.8 Audit Protection
CA.L2-3.12.1 Security Control Assessment
CA.L2-3.12.3 Security Control Monitoring
SI.L2-3.14.6 Monitor Communications for Attacks
SI.L2-3.14.7 Identify Unauthorized Use

NIST SP 800-53 Rev 5 LOW · 11 controls

AU-6 Audit Record Review, Analysis, and Reporting
CA-7 Continuous Monitoring
IR-1 Policy and Procedures
IR-5 Incident Monitoring
MA-4 Nonlocal Maintenance
SA-1 Policy and Procedures
SA-2 Allocation of Resources
SC-7 Boundary Protection
SI-4 System Monitoring
SI-5 Security Alerts, Advisories, and Directives
SR-10 Inspection of Systems or Components (SR-10)

CIS Controls v8 · 9 controls

CIS-1.2 Address Unauthorized Assets
CIS-13.1 Centralize Security Event Alerting
CIS-13.11 Tune Security Event Alerting Thresholds
CIS-13.2 Deploy a Host-Based Intrusion Detection Solution
CIS-13.3 Deploy a Network Intrusion Detection Solution
CIS-13.6 Collect Network Traffic Flow Logs
CIS-8.11 Conduct Audit Log Reviews
CIS-8.2 Collect Audit Logs
CIS-8.9 Centralize Audit Logs

NIST Cybersecurity Framework 2.0 · 7 controls

NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities
NIST-CSF-DE.AE-03 Information is correlated from multiple sources
NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events
NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring
NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated

SOC 2 · 6 controls

SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
SOC2-CC4.2 COSO principle 17: Evaluates and communicates deficiencies in a timely manner
SOC2-CC7.1 Detection and monitoring procedures for security events are in place
SOC2-CC7.2 Monitors system components for anomalies indicating malicious acts
SOC2-CC7.3 Evaluates security events to determine incident status
SOC2-CC7.4 Responds to identified security incidents through defined procedures

Azure Security Benchmark · 5 controls

ASBv3-LT-1 Enable threat detection capabilities
ASBv3-LT-2 Enable threat detection for identity and access management
ASBv3-NS-4 Deploy intrusion detection/intrusion prevention systems (IDS/IPS)
DP-2 Monitor anomalies and threats targeting sensitive data
LT-5 Centralize security log management and analysis

NIST SP 800-171 Rev 3 · 5 controls

03.03.04 Response to Audit Logging Process Failures
03.03.05 Audit Record Review, Analysis, and Reporting
03.03.06 Audit Record Reduction and Report Generation
03.12.03 Continuous Monitoring
03.14.06 System Monitoring

ASD Strategies to Mitigate Cyber Security Incidents · 4 controls

ASD37-28 Continuous incident detection and response (Excellent)
ASD37-29 Host-based IDS/IPS (Very Good)
ASD37-30 Endpoint detection and response (Very Good)
ASD37-32 Network-based IDS/IPS (Limited)

C5 (Germany) · 4 controls

C5-COS-01 Technical safeguards
C5-COS-03 Monitoring of connections in the Cloud Service Provider's network
C5-OPS-13 Logging and Monitoring - Identification of Events
C5-OPS-16 Logging and Monitoring - Configuration

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

CCM-IVS-09 Network Defense
CCM-LOG-01 Logging and Monitoring Policy and Procedures
CCM-LOG-03 Security Monitoring and Alerting
CCM-LOG-05 Audit Logs Monitoring and Response

HIPAA Security Rule · 4 controls

164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(a)(5)(ii)(C) Log-in Monitoring (Addressable)
164.312(b) Audit Controls (Standard)

NIST SP 800-66 Rev 2 · 4 controls

164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(a)(5)(ii)(C) Log-in Monitoring (Addressable)
164.312(b) Audit Controls (Standard)

AWS Well-Architected Security Pillar · 3 controls

SEC04-BP02 Capture logs, findings, and metrics in standardized locations
SEC04-BP03 Correlate and enrich security alerts
SEC04-BP04 Initiate remediation for non-compliant resources

DORA · 2 controls

DORA-Art.10 Detection
DORA-Art.16 Simplified ICT risk management framework

EU AI Act · 2 controls

EUAI-Art.26 Obligations of deployers of high-risk AI systems
EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems

ISO/IEC 42001:2023 · 2 controls

9.1 Monitoring, measurement, analysis and evaluation
A.6.2.6 AI system operation and monitoring

NIST SP 800-172 · 2 controls

3.11.2e Threat Hunting
3.14.2e Monitor Organizational Systems with Specialized Capabilities

ACSC Essential Eight · 1 control

E8-APP-ML3 Application Control (ML3)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-36 Enable and Configure Logging on the Most Important Components

APRA CPS 234 · 1 control

CPS234-30 Detection and Response Mechanisms

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-3 Audit logging and access monitoring

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-3 Information Security Category

ISO 22301:2019 · 1 control

9.1 Monitoring, measurement, analysis and evaluation

ISO 27002:2022 · 1 control

8.16 Monitoring activities

ISO 27701:2019 · 1 control

6.9.4 Logging and monitoring

NIS2 Directive · 1 control

Art.21.2.b Incident handling

NIST SP 800-161 Rev 1 · 1 control

161R1-SI-4 System Monitoring

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.