8.16 Monitoring activities
Requires networks, systems and applications to be monitored for anomalous behaviour, with appropriate action taken to evaluate whether what is observed constitutes an information security incident. Secondary commentary n
5
artefacts
3
held by a system
2
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The monitoring design showing what is monitored across networks, systems and applications, and against which baseline of normal behaviour · SIEM / log platform
- Alert handling records showing triage, the time to triage, and the evaluation deciding whether the alert was an incident · SIEM / log platform
- Evidence of monitoring coverage over cloud, identity and application layers, not only network and endpoint · Endpoint management (MDM / EDR)
periodic reviewEvidence produced at each review
- The detection rules or analytics in use, with evidence of how they were derived and their coverage of relevant threat behaviour · SIEM / log platform
- The tuning record, showing rules adjusted over time, false positives reduced and gaps closed · SIEM / log platform
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Baseline of normal behaviour never established, so anomaly cannot be defined and only known signatures are caught
- Alert volume beyond what the team can triage, so alerts are closed unexamined and the control is nominal
- Rules deployed at implementation and never tuned, so the same false positives are dismissed daily and a real one is dismissed with them
- Monitoring stops at the perimeter, leaving lateral movement and identity abuse undetected
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet