Security incidents rarely arrive without warning. The warning signs are almost always there inside your systems—if you are actually looking for them. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations collect millions of system log lines every single day, only to store them blindly in a folder and never look at them until a catastrophic breach occurs. Storing logs is passive; active monitoring is what gives you real situational awareness.
ISO 27001:2022 introduced Annex A 8.16 as a brand-new, dedicated control to solve this exact problem. It ensures your business actively monitors ICT activities, networks, and systems in real time, catching abnormal behaviour, system failures, and active attacks before they escalate into disaster.
Quick Summary: What ISO 27001 Annex A 8.16 Requires
At a practical level, Annex A 8.16 is about active visibility and continuous oversight. It reflects the modern reality that passive logging alone is completely useless without active detection. Here is what you need to do in plain English:
- Establish System Baselines: Define what “normal” network, user, and server behaviour looks like so you can spot anomalies.
- Monitor High-Risk Assets Continuously: Focus active monitoring on critical servers, databases, cloud links, and network boundaries.
- Track Resource Usage Spikes: Watch for sudden CPU, memory, or network spikes that indicate malware, mining, or system failure.
- Integrate Alerts with Incident Response: Ensure automated security alerts route directly to specific team members responsible for investigating.
- Tune Out Noise and False Positives: Refine monitoring rules regularly so your IT team is not overwhelmed by alert fatigue.
- Respect Legal and Privacy Laws: Ensure staff and user monitoring complies with local data privacy mandates (like GDPR).
Why Passive Logging Without Monitoring Is a Critical Risk
If you only collect system logs without active monitoring, you are operating completely blind. Most major cyber attacks occur over days or weeks, with attackers probing networks, escalating privileges, and testing access rules. Active monitoring allows you to catch these early warning signs and stop attackers at step one.
Failing to monitor system activities actively exposes your business to severe hazards:
- Undetected Long-Term Intrusions: Hackers sitting quietly inside your corporate network for months, extracting sensitive data without trigger warnings.
- Ignored Critical Alerts: Security tools generating critical warning signals that go completely unread because no one owns alert management.
- Delayed Incident Containment: Discovering a major system outage or ransomware infection hours after it could have been contained.
- Insider Misuse: Disgruntled or compromised employees accessing sensitive client records or downloading bulk databases without oversight.
My 12 Step Plan to Implement Annex A 8.16 Fast
You do not need an expensive 24/7 Security Operations Centre (SOC) to satisfy an ISO 27001 auditor. Here is my pragmatic, 12-step plan to establish an audit-ready, continuous monitoring framework.
1. Define the Scope of Monitoring Activities
Do not try to monitor everything equally on day one. Prioritise monitoring based on asset criticality and business risk:
- Core business databases, active directories, and cloud management consoles.
- Public-facing web applications, firewalls, and internet gateways (Annex A 8.20).
- Privileged admin accounts, remote desktop access, and VPN endpoints (Annex A 8.2).
2. Establish Operational Baselines
You cannot identify abnormal system behavior if you do not know what normal looks like. Define baseline activity profiles:
- Document standard working hours, expected user access locations, and typical transaction volumes.
- Establish baseline CPU, memory, storage, and network bandwidth utilisation levels for core servers.
- Map expected internal data flow paths between subnets (Annex A 8.22).
3. Monitor Network Traffic and Boundaries
Network activity provides the earliest indicator of compromise. Keep active watch over network boundaries:
- Monitor inbound and outbound connection attempts at your firewalls and cloud gateways.
- Set up alerts for traffic going to known malicious IP addresses or unapproved geographic regions.
- Watch for sudden, unexpected spikes in outbound data transfers (potential data exfiltration).
4. Monitor Computing Resource Consumption
Unusual resource consumption often signals background malware execution, system misconfigurations, or service failures:
- Track CPU, RAM, and disk storage usage across live operational servers (Annex A 8.6).
- Set up automated alerts for sustained resource spikes (e.g., CPU pegged at 99% for over 15 minutes).
- Investigate unexpected process terminations or sudden crashes in core software services.
5. Implement System Integrity Monitoring
Detect unauthorised modifications to critical system files, configurations, and core application binaries:
- Deploy File Integrity Monitoring (FIM) tools on critical production servers and domain controllers.
- Monitor for unauthorized changes to firewall rules, registry settings, or system configuration files.
- Alert immediately when new executable files or scripts are run inside restricted system directories.
6. Feed System Logs Directly into Monitoring Tools
Connect your logging infrastructure (Annex A 8.15) directly into active monitoring and correlation platforms:
- Forward log feeds from firewalls, servers, cloud services, and endpoints into a central SIEM or log management tool.
- Correlate events across different systems (e.g., linking a firewall entry alert to a simultaneous server login).
- Ensure monitoring systems query synchronized UTC timestamps across all log sources (Annex A 8.17).
7. Configure Actionable, Risk-Based Alerts
Raw monitoring data is useless without actionable alerts. Configure thresholds that demand immediate human review:
- Define explicit severity levels for alerts (Low, Medium, High, Critical).
- Trigger instant high-priority alerts for multiple failed admin logins, privilege escalations, or disabled security software.
- Tune alert rules monthly to eliminate noise and prevent developer or IT team alert fatigue.
8. Deploy Scalable Monitoring Tools
Select monitoring software and tools that fit your organization’s specific technical architecture, scale, and budget:
- Use cloud-native monitoring tools (like AWS CloudWatch, Azure Monitor, or Google Chronicle) for cloud infrastructure.
- Deploy Endpoint Detection and Response (EDR) agents across employee laptops and production servers.
- Ensure monitoring tools are resilient and continue operating even if individual network nodes fail.
9. Ensure Continuous Monitoring for Critical Infrastructure
High-risk systems require continuous, automated oversight rather than periodic manual reviews:
- Automate continuous 24/7 scanning and alerting for public-facing firewalls and core application databases.
- Build redundancy into monitoring server nodes so monitoring capability does not drop offline during outages.
- Protect monitoring software configurations from unauthorized modification or disabling by local users.
10. Assign Clear Ownership and Triage Roles
An alert that goes to a shared, unmonitored inbox is an alert that will be missed. Establish clear human accountability:
- Assign explicit duty roles responsible for reviewing and triaging incoming security alerts daily.
- Establish clear escalation paths for handing off critical alerts to senior incident leads.
- Document response time SLAs for investigating high and critical security events.
11. Connect Monitoring Directly to Incident Management
Monitoring is the primary trigger for your incident response playbooks. Ensure smooth transition from detection to action:
- Automate ticket creation inside your IT service management tool whenever a critical security alert fires.
- Feed monitoring evidence directly into incident containment and forensic investigation workflows.
- Incorporate monitoring alert review steps into post-incident reviews to improve future detection rules.
12. Ensure Compliance with Privacy and Employee Laws
Monitoring user activity can touch personal data and employee privacy rights. Keep your monitoring lawful:
- Publish clear Acceptable Use Policies informing staff that corporate systems are monitored.
- Ensure employee desktop monitoring is proportionate, documented, and focused on security rather than micromanagement.
- Restrict access to monitoring logs containing personal user data strictly to authorized security leads.
Common Implementation Pitfalls and How to Fix Them
When preparing clients for ISO 27001 audits, I frequently spot the same monitoring mistakes. Here are the main traps and how to solve them:
- Problem: Alert Fatigue Causing Teams to Ignore Critical Warnings
Ninja Solution: Prune low-priority alerts ruthlessly and focus active notifications strictly on actionable, high-risk security events. - Problem: Monitoring Tools Operating in Fragmented Silos
Ninja Solution: Centralise log feeds and alert dashboards into a single SIEM or unified monitoring platform. - Problem: No Baseline of Normal Behaviour Established
Ninja Solution: Run monitoring tools in learning mode for 30 days to map standard operational baselines before locking in alert rules. - Problem: Nobody Assigned to Review Generated Security Alerts
Ninja Solution: Assign explicit, named daily responsibilities for checking monitoring dashboards and triaging open alerts.
The ISO 27001 Ninja Bottom Line
ISO 27001 Annex A 8.16 is about seeing what is happening across your systems in time to make a difference. Prevention is never perfect, but rapid detection is what stops a minor anomaly from turning into a business-ending breach.
By defining clear scope, establishing operational baselines, tracking network and resource usage, setting up actionable alerts, and assigning clear human ownership, you turn passive logs into an active defensive shield that keeps your business secure and completely ready for audit success.