Frameworks / ISO 27001:2022 / 8.16 ISO 27001:2022
Technological controls – ISO 27001:2022
ISO 27001:2022 8.16: Monitoring activities Networks, systems and applications are to be monitored for anomalous behaviour, with appropriate steps taken to evaluate possible information security incidents. Purpose (stated in ISO/IEC 27002:2022): spots abnormal behaviour and possible security incidents. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.16.
Maintained by Gerard Blokdyk · Verified against the published standard 18 August 2026 · Control text last updated 25 September 2026 What else in your programme already covers this This control maps to 189 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AC-17(1) Monitoring and Control AC-2(12) Account Monitoring for Atypical Usage AC-2(7) Privileged User Accounts AU-6 Audit Record Review, Analysis, and Reporting AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation AU-7(1) Automatic Processing CA-7 Continuous Monitoring CA-8(2) Penetration Testing | Red Team Exercises (CA-8(2)) CM-12(1) Information Location | Automated Tools to Support Information Location (CM-12(1)) CM-8(3) Automated Unauthorized Component Detection IR-1 Policy and Procedures IR-4(1) Automated Incident Handling Processes IR-5 Incident Monitoring IR-6(1) Automated Reporting IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) MA-4 Nonlocal Maintenance SA-1 Policy and Procedures SA-2 Allocation of Resources SC-7 Boundary Protection SI-4 System Monitoring SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1)) SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis SI-4(23) System Monitoring | Host-based Devices (SI-4(23)) SI-4(5) System-Generated Alerts SI-5 Security Alerts, Advisories, and Directives SI-7(7) Integration of Detection and Response SR-10 Inspection of Systems or Components (SR-10) AC-17(1) Monitoring and Control AC-2(12) Account Monitoring for Atypical Usage AC-2(7) Privileged User Accounts AU-6 Audit Record Review, Analysis, and Reporting AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation AU-7(1) Automatic Processing CA-7 Continuous Monitoring CA-8(2) Penetration Testing | Red Team Exercises (CA-8(2)) CM-12(1) Information Location | Automated Tools to Support Information Location (CM-12(1)) CM-8(3) Automated Unauthorized Component Detection IR-1 Policy and Procedures IR-4(1) Automated Incident Handling Processes IR-5 Incident Monitoring IR-6(1) Automated Reporting IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) MA-4 Nonlocal Maintenance SA-1 Policy and Procedures SA-2 Allocation of Resources SC-7 Boundary Protection SI-4 System Monitoring SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1)) SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(2) Automated Tools and Mechanisms for Real-Time Analysis SI-4(23) System Monitoring | Host-based Devices (SI-4(23)) SI-4(5) System-Generated Alerts SI-5 Security Alerts, Advisories, and Directives SI-7(7) Integration of Detection and Response SR-10 Inspection of Systems or Components (SR-10) 10.4.1 10.4.1 Daily review of security-relevant logs 10.4.1.1 10.4.1.1 Automated mechanisms used for audit log review 10.4.2 10.4.2 Periodic review of all other system component logs 10.4.3 10.4.3 Exceptions and anomalies from log review addressed 10.7.1 10.7.1 Service providers detect critical control failures (superseded) 10.7.2 10.7.2 Detect and alert on critical security control failures 11.4.5 11.4.5 Annual segmentation penetration testing 11.4.6 11.4.6 Service provider segmentation testing every six months 11.5.1 11.5.1 IDS/IPS monitoring of CDE traffic 11.5.1.1 11.5.1.1 Service providers detect covert malware channels 11.6.1 11.6.1 Payment page tamper detection 12.10.5 12.10.5 Plan covers alerts from security monitoring systems 12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews 6.4.2 6.4.2 Automated web attack detection and prevention 9.2.3 9.2.3 Physical protection of network hardware and lines 6.4.3 6.4.3 Payment page script management CIS-1.2 Address Unauthorized Assets CIS-13.1 Centralize Security Event Alerting CIS-13.11 Tune Security Event Alerting Thresholds CIS-13.2 Deploy a Host-Based Intrusion Detection Solution CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-13.6 Collect Network Traffic Flow Logs CIS-8.11 Conduct Audit Log Reviews CIS-8.2 Collect Audit Logs CIS-8.9 Centralize Audit Logs NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.AE-03 Information is correlated from multiple sources NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16) SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents SOC2-CC7.4 CC7.4 Responding to security incidents ASBv3-LT-1 Enable threat detection capabilities ASBv3-LT-2 Enable threat detection for identity and access management ASBv3-NS-4 Deploy intrusion detection/intrusion prevention systems (IDS/IPS) DP-2 Monitor anomalies and threats targeting sensitive data LT-5 Centralize security log management and analysis 03.03.04 Response to Audit Logging Process Failures 03.03.05 Audit Record Review, Analysis, and Reporting 03.03.06 Audit Record Reduction and Report Generation 03.12.03 Continuous Monitoring 03.14.06 System Monitoring ASD37-28 Continuous incident detection and response (Excellent) ASD37-29 Host-based IDS/IPS (Very Good) ASD37-30 Endpoint detection and response (Very Good) ASD37-32 Network-based IDS/IPS (Limited) C5-COS-01 Technical safeguards C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-OPS-13 Logging and Monitoring - Identification of Events C5-OPS-16 Logging and Monitoring - Configuration SEC04-BP02 Capture logs, findings, and metrics in standardized locations SEC04-BP03 Correlate and enrich security alerts SEC04-BP04 Initiate remediation for non-compliant resources BAI04.04 BAI04.04 Monitor and review availability and capacity DSS01.03 DSS01.03 Monitor I&T infrastructure DSS05.07 DSS05.07 Manage vulnerabilities and monitor the infrastructure for security-related events EUAI-Art.26 Obligations of deployers of high-risk AI systems EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems 9.1 Monitoring, measurement, analysis and evaluation A.6.2.6 AI system operation and monitoring 3.11.2e Threat Hunting 3.14.2e Monitor Organizational Systems with Specialized Capabilities 3(2)(f) Regulation 3(2)(f) Purpose: investigating or detecting unauthorised use of a telecommunication system 3(2)(g) Regulation 3(2)(g) Purpose: securing, or as an inherent part of, the effective operation of the system E8-APP-ML3 Application Control (ML3) ANSSI-HYG-36 Enable and Configure Logging on the Most Important Components CPS234-30 Detection and Response Mechanisms AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment 9.1 Monitoring, measurement, analysis and evaluation 8.16 Monitoring activities 6.9.4 Logging and monitoring Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Technological controls – ISO 27001:2022 You are reading one control. How much of ISO 27001:2022 have you already done? ISO 27001:2022 8.16 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 189 it maps to, and the evidence behind each claim, over MCP and REST.