ISO 27001 Annex A 8.16 Monitoring networks and systems for anomalous behaviour
What it says
Networks, systems and applications shall be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check networks and systems for unusual activity to address potential security threats.
This control is about regularly checking your business's computers and networks for anything unusual. It's like making sure there are no strangers hanging out in your yard. If you don't do this, you might miss signs of a cyber-attack or data breach that could harm your business.
Free. Save your status, tasks and notes.
Why it matters
Without continuous monitoring, anomalous activity (e.g., unauthorised access or lateral movement) can go unnoticed, increasing breach impact and service disruption.
How to implement
IT manager should set up and regularly update a monitoring system.
Use software that keeps an eye on your network traffic and computer usage for anything out of the ordinary. This can help catch threats early and prevent them from getting worse.
IT staff should define what 'normal behaviour' looks like for all systems and networks.
They can do this by analysing usual activity levels during different times, such as peak work hours and downtime. This baseline makes it easier to spot unusual movements.
Security team should configure alerts for suspicious activity.
The monitoring tools should be able to notify the team immediately if they detect any strange activities. Make sure these alerts are fine-tuned to reduce false alarms and ensure real threats are prioritised.
Business owner should involve someone to keep an eye on the alerts.
Designate a team member responsible for responding to alerts. This person needs training on what different alerts mean and how to handle them properly.
Compliance officer should ensure that data collection respects privacy laws.
Check that your monitoring activities comply with the Australian Privacy Act 1988 and any other relevant legal requirements. This ensures that your customers' and employees' information remains confidential while it is being monitored.
Keep it running
Baseline normal network/system activity, centralise and correlate logs (SIEM), tune alerts for anomalies, and define triage and escalation steps to evaluate potential incidents.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The monitoring policy document and system baseline.
Look at
How it defines normal behaviour and details the alerts configuration.
Good evidence
Policy will clearly outline procedures for both monitoring and responding to incidents.
- Check 2 of 5What an auditor asks for
Ask for
To see recent monitoring logs and alert reports.
Look at
The frequency and type of alerts that have been triggered. Good logs will have timestamps and details that match the defined baseline and alert policy.
- Check 3 of 5What an auditor asks for
Ask for
Staff about the process for handling alerts.
Look at
Response times and any follow-up actions taken.
Good evidence
Will describe a clear process and recent examples of effective responses.
- Check 4 of 5What an auditor asks for
Ask for
Any recent incident reports linked to network monitoring.
Look at
How the incidents were detected and resolved. Good incident reports will show the monitoring system's role in catching and addressing anomalies.
- Check 5 of 5What an auditor asks for
Ask for
If there have been any updates to the monitoring software or practices.
Look at
The logs for software updates or policy revisions. Good records will show regular updates that reflect current threats and improvements in monitoring capabilities.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.7, Event logs from internet-facing servers are analysed to detect cyber security events, which this control covers in full and more.
ASD Essential Eight: 18 mappings
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsBroader than
This control is broader than E8-AC-ML2.7.
E8-AC-ML2.7 requires timely analysis of internet-facing server event logs to detect cyber security events. Annex A 8.16 is broader, requiring monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents. Log analysis of internet-facing servers is one monitoring method that supports Annex A 8.16, but the ISO control extends beyond logs and beyond internet-facing servers.
This control is broader than E8-AC-ML3.4.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader, requiring monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents. E8-AC-ML3.4 is one concrete monitoring/detection mechanism (server event log analysis) within the wider monitoring scope of Annex A 8.16.
This control is broader than E8-AC-ML3.5.
E8-AC-ML3.5 requires organisations to promptly analyse workstation event logs to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring networks, systems, and applications for anomalous behaviour and taking actions to evaluate potential incidents, which includes (but is not limited to) log-based monitoring. E8-AC-ML3.5 is a specific subset of this broader monitoring requirement, focused on workstation event logs and timely analysis.
This control is broader than E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader because it requires monitoring networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which can include telemetry beyond logs. E8-AH-ML2.14 is one specific monitoring method (log analysis) applied to a specific high-risk system class.
This control is broader than E8-AH-ML3.4.
E8-AH-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader, requiring monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents. E8-AH-ML3.4 overlaps as a concrete log-analysis activity that supports anomalous behaviour detection, but Annex A 8.16 also covers other monitoring methods beyond log review.
This control is broader than E8-AH-ML3.5.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalies and incident evaluation, including log analysis as a method. E8-AH-ML3.5 is log-analysis focused and specific to workstations, whereas Annex A 8.16 is broader.
This control is broader than E8-MF-ML2.8.
E8-MF-ML2.8 focuses on timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which can be implemented using log analysis among other telemetry. E8-MF-ML2.8 is one specific monitoring mechanism that contributes to meeting the broader monitoring requirement in Annex A 8.16.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsBroader than
This control is broader than E8-MF-ML3.4.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader as it requires monitoring networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents. E8-MF-ML3.4 is one concrete monitoring activity that contributes to meeting Annex A 8.16 for internal servers.
This control is broader than E8-MF-ML3.5.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This relates to Annex A 8.16 because monitoring systems for anomalous behaviour commonly relies on workstation telemetry and log analysis as an input to identify potential incidents. Annex A 8.16 is broader as it covers monitoring across networks, systems and applications and includes taking actions to evaluate potential incidents, not just analysing workstation logs.
This control is broader than E8-RA-ML2.9.
E8-RA-ML2.9 focuses on promptly analysing internet-facing server event logs to detect cyber security events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents, which can include but is not limited to log analysis. E8-RA-ML2.9 is a specific implementation approach within the broader monitoring expectation of Annex A 8.16.
This control is broader than E8-RA-ML3.9.
Annex A 8.16 requires organisations to monitor networks, systems and applications for anomalous behaviour and take action to evaluate potential incidents. E8-RA-ML3.9 relates by mandating timely analysis of workstation event logs to detect security events, which is one concrete monitoring activity that can reveal anomalies. Annex A 8.16 is broader because it is not limited to workstations or to log analysis, and also expects appropriate follow-up actions beyond detection.
This control partially overlaps E8-AC-ML2.8.
E8-AC-ML2.8 requires cyber security events to be analysed in a timely manner to identify incidents. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents, which includes analysis/triage activities. Annex A 8.16 is broader because it explicitly covers establishing monitoring for anomalies, whereas E8-AC-ML2.8 focuses on the timely analysis step to determine incident status.
This control partially overlaps E8-AH-ML2.15.
E8-AH-ML2.15 requires cyber security events to be analysed timely to identify incidents. Annex A 8.16 requires monitoring for anomalous behaviour and evaluating potential incidents, which includes relevant triage and analysis activities.
This control partially overlaps E8-MF-ML2.9.
E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify incidents. Annex A 8.16 requires monitoring networks/systems/applications for anomalous behaviour and taking actions to evaluate potential incidents, which overlaps with analysing events to decide if they indicate an incident. Annex A 8.16 is broader in including continuous monitoring and anomaly detection, while E8-MF-ML2.9 focuses on timely analysis of events to identify incidents.
This control partially overlaps E8-RA-ML2.10.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 8.16 requires monitoring for anomalous behaviour and taking appropriate actions to evaluate potential information security incidents, which includes analysis activities aligned to E8-RA-ML2.10. Annex A 8.16 is broader in explicitly requiring continuous monitoring and response actions, while E8-RA-ML2.10 is specifically about timely analysis to classify events as incidents.
This control depends on E8-AC-ML2.5.
E8-AC-ML2.5 requires organisations to centrally log allowed and blocked application control events. This supports ISO/IEC 27001:2022 Annex A 8.16 by providing a key telemetry source to monitor systems and applications for anomalous behaviour such as unexpected execution attempts or blocked binaries. Annex A 8.16 focuses on monitoring and response actions, whereas E8-AC-ML2.5 focuses specifically on ensuring the relevant events are centrally captured.
This control depends on E8-AH-ML2.12.
E8-AH-ML2.12 requires command line process creation events to be centrally logged, providing visibility of execution behaviour across endpoints/servers. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents. E8-AH-ML2.12 supports Annex A 8.16 by supplying a key telemetry stream for anomaly detection and investigation, but Annex A 8.16 includes broader monitoring and response actions beyond logging.
This control depends on E8-RA-ML2.6.
E8-RA-ML2.6 requires privileged access events to be centrally logged to allow oversight and detection of misuse. Annex A 8.16 focuses on monitoring networks, systems and applications for anomalous behaviour and taking appropriate action. Centralised privileged-access logs produced under E8-RA-ML2.6 directly strengthen Annex A 8.16 by providing high-value telemetry for anomaly detection and incident evaluation, even though Annex A 8.16 is broader than privileged access alone.
ASD Information Security Manual: 36 mappings
This control is broader than ISM-1028.
ISM-1028 requires a NIDS/NIPS at network gateways to detect and/or prevent unauthorised or malicious traffic crossing organisational boundaries. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents. A gateway NIDS/NIPS implemented under ISM-1028 provides a key telemetry and alerting source that strengthens the monitoring outcomes required by Annex A 8.16, but Annex A 8.16 is broader and not limited to gateways or IDS/IPS technology.
This control is broader than ISM-1030.
ISM-1030 requires deploying a NIDS/NIPS at the gateway perimeter and generating event logs and alerts for traffic that contravenes firewall rules. Annex A 8.16 requires monitoring networks/systems/applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents, which commonly includes IDS/IPS capabilities at network boundaries. ISM-1030 is narrower because it specifies a particular control location and detection basis (firewall rule violations), whereas Annex A 8.16 covers wider anomaly monitoring and response across many environments.
This control is broader than ISM-1213.
ISM-1213 requires a specific post-intrusion activity: capturing full network traffic for at least seven days to confirm removal of an attacker. Annex A 8.16 involves ongoing monitoring of networks and applications for anomalies. ISM-1213 specifies a time-bound action focused on post-remediation assurance, fitting within the broader monitoring scope of Annex A 8.16.
This control is broader than ISM-1607.
ISM-1607 focuses on integrity monitoring and centralised logging for server hardware shared via software isolation. Annex A 8.16 mandates broader monitoring of networks, systems, and applications for anomalies, exceeding ISM-1607's specific scope.
This control is broader than ISM-1976.
ISM-1976 requires security-relevant events for Apple macOS operating systems to be centrally logged. ISO/IEC 27001:2022 Annex A 8.16 requires organisations to monitor networks, systems and applications for anomalous behaviour and take appropriate actions, which typically relies on logging and telemetry across the environment. ISM-1976 is a specific logging implementation for one OS, whereas Annex A 8.16 is broader and outcome-focused on detection and response.
This control is broader than ISM-2089.
ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies in model behaviour or outputs. Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour and taking action to evaluate potential information security incidents, which can include AI services and their supporting platforms. ISM-2089 is a specific, AI-focused instantiation of Annex A 8.16's broader anomaly monitoring and evaluation requirement with emphasis on model metrics and output integrity rather than general system telemetry.
This control is broader than ISM-2114.
ISM-2114 requires establishing baselines for AI application behaviour and performance and monitoring for deviations. Annex A 8.16 focuses on monitoring for anomalous behaviour across networks, systems, and applications and aligns with security anomaly detection. ISM-2114 is more specific to baselines and AI deviations, while Annex A 8.16 is broader.
This control partially meets ISM-0582.
Annex A 8.16 requires ongoing monitoring for anomalous behaviour across networks and systems and taking action to evaluate potential incidents. ISM-0582 relates by requiring central logging of security-relevant Windows events, which provides a core telemetry source for detecting anomalies and investigating incidents. Annex A 8.16 is broader because it does not prescribe central logging and covers monitoring and response actions across all platforms, not only Windows.
This control partially meets ISM-1978.
ISM-1978 requires security-relevant events for server applications on internet-facing servers to be centrally logged. ISO/IEC 27001:2022 Annex A 8.16 is broader, requiring monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents. Centralised logging in ISM-1978 is one common mechanism that supports and partially implements the monitoring expectation, but Annex A 8.16 includes broader detection and response activities beyond logging.
This control partially meets ISM-1979.
Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour with actions taken to evaluate possible incidents. ISM-1979 relates by requiring central logging of security-relevant events for server applications on non-internet-facing servers, which supports detection and investigation of anomalies. Annex A 8.16 is broader because it covers active monitoring and incident evaluation across all environments, not just central log collection for a specific server class.
This control partially overlaps ISM-0652.
ISM-0652 requires files identified as suspicious by content filtering to be quarantined pending review and release decision. Annex A 8.16 requires monitoring of networks, systems, and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents, which can include triggering containment actions such as isolating or quarantining suspicious artefacts. The overlap is in detection-to-action workflows (flagging suspicious content and responding), but Annex A 8.16 focuses on behavioural monitoring and incident evaluation while ISM-0652 focuses specifically on quarantining filtered files until human/automated review completes.
This control partially overlaps ISM-1431.
ISM-1431 requires organisations to agree denial-of-service (DoS) mitigation arrangements with cloud service providers, including monitoring, notification thresholds and pre-approved response actions. Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents, which includes detecting DoS conditions and triggering response. ISM-1431 is specifically about contractual/operational coordination with cloud providers and upstream blocking, while Annex A 8.16 is a general internal monitoring requirement not specific to cloud or DoS.
- ISM-1526System owners continuously monitor security and manage threats, risks and controlsPartially overlaps
This control partially overlaps ISM-1526.
ISM-1526 requires continuous monitoring of each system's security and ongoing management of cyber threats, risks and controls based on system boundaries and objectives. Annex A 8.16 supports this by requiring monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, directly strengthening continuous monitoring. ISM-1526 includes additional scoping and ownership governance, while Annex A 8.16 is more prescriptive about monitoring for anomalies and follow-up evaluation.
This control partially overlaps ISM-1556.
ISM-1556 requires personnel returning from high-risk overseas travel with mobile devices to reset credentials and monitor user accounts for compromise. Annex A 8.16 involves monitoring networks, systems and applications for suspicious behaviour, supporting ISM-1556's goal to identify suspicious activity. Annex A 8.16 is broader, covering general monitoring, while ISM-1556 focuses on post-travel actions.
This control partially overlaps ISM-1625.
ISM-1625 requires an insider threat mitigation program to be developed, implemented and maintained. Monitoring networks, systems and applications for anomalous behaviour under Annex A 8.16 is a key detection capability for such a program, as it surfaces unusual activity by authorised users. The insider threat program also covers personnel and procedural measures that Annex A 8.16 does not, while Annex A 8.16 also addresses external threats.
This control partially overlaps ISM-1987.
ISM-1987 requires timely analysis of event logs from security products to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which commonly uses log analysis alongside other telemetry. The overlap is in detection and evaluation activities, but Annex A 8.16 is broader than log review (e.g. behavioural and network monitoring) while ISM-1987 is specifically log-analysis timeliness.
This control depends on ISM-0120.
ISM-0120 requires cyber security personnel to have sufficient data sources and tools to monitor systems for key indicators of compromise. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which depends on having effective monitoring tools and accessible telemetry. Annex A 8.16 sets an operational monitoring requirement, while ISM-0120 focuses on enabling capability (tooling and data access) rather than mandating monitoring activities themselves.
This control depends on ISM-0261.
ISM-0261 requires organisations to centrally log detailed web proxy activity to provide visibility of user web access and associated network attributes. ISO/IEC 27001:2022 Annex A 8.16 focuses on monitoring networks/systems/applications for anomalous behaviour, relying on high-quality logs like those specified in ISM-0261 for detecting suspicious web activity. ISM-0261 provides necessary telemetry but does not mandate monitoring or response.
This control depends on ISM-0263.
ISM-0263 requires decryption and inspection of TLS traffic through gateways to enable security visibility into encrypted communications. Annex A 8.16 requires monitoring networks and systems for anomalous behaviour and taking action to evaluate potential incidents; TLS inspection directly improves the fidelity of network monitoring by allowing detection of threats hidden in encrypted flows. Annex A 8.16 is broader (monitoring in general), whereas ISM-0263 is a specific mechanism to make monitoring effective for TLS traffic.
This control depends on ISM-0585.
ISM-0585 requires log entries to include sufficient detail (time, user/process, filename where relevant, event description, and equipment) to interpret activity. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which relies on high-quality telemetry to detect and triage anomalies. Annex A 8.16 is about monitoring and operational response, while ISM-0585 improves the fidelity of the underlying event data used for that monitoring.
This control depends on ISM-0634.
ISM-0634 requires central logging of gateway traffic and intrusion-related alerts to provide visibility of network flows through gateways. Annex A 8.16 requires monitoring of networks/systems/applications for anomalous behaviour and taking action to evaluate potential incidents. Centralised gateway logs and alerts from ISM-0634 provide key inputs that enable the anomaly detection and evaluation activities required by Annex A 8.16.
This control depends on ISM-1034.
ISM-1034 requires a HIPS or EDR solution on critical servers and high-value servers. These tools watch host activity for anomalous and malicious behaviour and raise alerts for investigation, which supports the monitoring for anomalous behaviour and evaluation of potential incidents required by Annex A 8.16. Annex A 8.16 covers monitoring across networks, systems and applications, whereas ISM-1034 provides a host-level detection and prevention capability on a subset of servers.
This control depends on ISM-1341.
ISM-1341 requires HIPS or EDR on workstations to detect suspicious activity and enable response at the endpoint. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents. Workstation EDR telemetry and detections directly strengthen the organisation's ability to monitor for anomalies, but Annex A 8.16 is broader because it also includes network and application monitoring beyond endpoints.
This control depends on ISM-1430.
ISM-1430 mandates stateful DHCPv6 use and centralized logging of lease data to support network monitoring. This aids compliance with Annex A 8.16 by contributing to the detection of anomalous network behavior through enhanced visibility of IPv6 address allocation.
This control depends on ISM-1537.
ISM-1537 requires organisations to centrally log a rich set of database security events so suspicious activity and misuse can be detected and investigated. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate incidents. Centralised, high-fidelity database logs from ISM-1537 provide critical telemetry to enable the anomaly detection and investigation activities expected by Annex A 8.16, but 8.16 also covers response actions and broader monitoring beyond databases.
This control depends on ISM-1566.
ISM-1566 requires that use of unprivileged access is centrally logged so user activity can be monitored and investigated. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents, which relies on high-quality centralised event visibility. ISM-1566 supports Annex A 8.16 by ensuring a key telemetry source (unprivileged user activity) is available for anomaly detection, even though Annex A 8.16 also encompasses broader monitoring methods beyond logging.
This control depends on ISM-1650.
ISM-1650 requires central logging of privileged user account and security group management events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour, which is enabled by having high-value audit data such as privileged account and group changes captured centrally under ISM-1650. Annex A 8.16 is detection/monitoring oriented, while ISM-1650 is a specific logging requirement that feeds those monitoring activities.
This control depends on ISM-1830.
ISM-1830 requires that security-relevant events on Microsoft AD-related servers are centrally logged. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions. Centralised AD server logging under ISM-1830 directly strengthens the ability to detect identity-related anomalies (e.g. suspicious authentication and directory changes), but Annex A 8.16 also covers monitoring/response activities beyond log collection.
This control depends on ISM-1889.
ISM-1889 requires central logging of command line process creation events to improve visibility of potentially suspicious execution behaviour. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents. Centralised command line process creation logs from ISM-1889 materially strengthen detection and investigation under Annex A 8.16, but Annex A 8.16 also covers broader telemetry and response actions beyond this single log source.
This control depends on ISM-1911.
ISM-1911 mandates centralised logging of software usage, errors, and crashes, which aids the monitoring and evaluation of anomalies under ISO/IEC 27001:2022 Annex A 8.16. While the latter requires broader monitoring, logging as per ISM-1911 supports identifying anomalous behaviour.
This control depends on ISM-1963.
ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged. Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour, which is materially enabled by centralised logging from edge and internet-facing devices to detect anomalies and investigate incidents. Annex A 8.16 is broader (monitoring and response), while ISM-1963 is a foundational telemetry collection requirement focused on device logs.
This control depends on ISM-2015.
ISM-2015 mandates central logging of non-internet API calls that modify or access sensitive data. Annex A 8.16 supports this by necessitating network, system, and application monitoring to detect anomalies, which often relies on centrally logged data like API access records.
This control depends on ISM-2051.
ISM-2051 mandates generating sufficient event logs for cybersecurity detection. ISO/IEC 27001:2022 Annex A 8.16 involves monitoring for anomalies and potential incidents, which necessitates relevant logs. ISM-2051 supports this by ensuring the necessary log data exists.
This control depends on ISM-2116.
ISM-2116 requires use of cyber threat intelligence services to improve the detection of cyber security events and identification of incidents. ISO/IEC 27001 Annex A 8.16 requires monitoring for anomalous behaviour and taking action to evaluate potential incidents, and ISM-2116 strengthens this by supplying concrete adversary context (e.g. current campaigns, TTPs, malicious infrastructure) to convert "anomalies" into higher-confidence detections and faster evaluations. Annex A 8.16 sets the monitoring/evaluation obligation, while ISM-2116 provides the intelligence-driven content and prioritisation that makes that monitoring materially more effective.
This control depends on ISM-2117.
ISM-2117 requires suitable AI models to augment detection of cyber security events and identification of incidents. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring networks, systems, and applications for anomalous behaviour and taking action to evaluate potential incidents, which is a core detection use-case that AI models can materially improve (e.g., anomaly detection, alert triage). Annex A 8.16 is technology-agnostic and can be met without AI, while ISM-2117 is specifically about using AI as an augmentation technique rather than establishing the baseline monitoring requirement.
This control depends on ISM-2153.
ISM-2153 requires quarterly threat hunting that is informed by current strategic and sector-specific cyber threat intelligence. Annex A 8.16 requires monitoring networks, systems, and applications for anomalous behaviour, which provides the visibility and telemetry that threat hunting benefits from. Without effective anomaly monitoring, ISM-2153 hunts are constrained because insufficient data exists to test hypotheses.
ASD Essentials for enterprise IT: 8 mappings
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionBroader than
This control is broader than IT.DET-02.2.
IT.DET-02.2 requires detection logic that identifies unauthorised changes, anomalous authentication activity and suspicious software execution. This is a specific implementation of the monitoring for anomalous behaviour that Annex A 8.16 requires across networks, systems and applications. Annex A 8.16 is broader, as it is not limited to these activities and also requires appropriate action to evaluate potential information security incidents.
This control is broader than IT.DET-03.1.
IT.DET-03.1 requires alerts and events to be triaged in a timely manner to determine whether cyber security incident thresholds have been met. This corresponds to the part of Annex A 8.16 that requires appropriate actions to be taken to evaluate potential information security incidents. Annex A 8.16 is broader, as it also requires networks, systems and applications to be monitored for anomalous behaviour.
- IT.DET-03.2Correlate signals across identities, applications, data and infrastructure to identify incidentsBroader than
This control is broader than IT.DET-03.2.
IT.DET-03.2 requires indicators from across identities, applications, data and infrastructure activity, rather than isolated signals, to be used when identifying cyber security incidents. This sets a specific expectation for how the monitoring and evaluation of potential incidents required by Annex A 8.16 is carried out. Annex A 8.16 covers monitoring networks, systems and applications for anomalous behaviour more broadly but does not require indicators to be correlated across sources.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsBroader than
This control is broader than IT.DET-04.1.
IT.DET-04.1 requires software execution behaviour on systems to be continuously monitored and analysed to detect legitimate tools and utilities being used for malicious purposes. This is a specific form of the monitoring for anomalous behaviour that Annex A 8.16 requires across networks, systems and applications. Annex A 8.16 is broader in coverage and also requires appropriate action to evaluate potential incidents, while IT.DET-04.1 focuses on the malicious use of legitimate tools.
- IT.PRO-09.1Inspect outbound content on egress paths to detect unauthorised data transfersBroader than
This control is broader than IT.PRO-09.1.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data. Detecting possible exfiltration in network traffic is a specific form of the monitoring for anomalous behaviour required by Annex A 8.16, and its alerts feed the evaluation of potential information security incidents. Annex A 8.16 is broader, covering monitoring of networks, systems and applications for all kinds of anomalous behaviour.
- IT.RES-04.2Evaluate monitoring coverage and response procedures after incidents and validate improvementsPartially overlaps
This control partially overlaps IT.RES-04.2.
IT.RES-04.2 requires monitoring coverage and cyber security incident response procedures to be evaluated following cyber security incidents. Evaluating monitoring coverage after an incident exposes blind spots and so strengthens the monitoring of networks, systems and applications for anomalous behaviour required by Annex A 8.16. IT.RES-04.2 is a post-incident evaluation, while Annex A 8.16 covers ongoing monitoring and the evaluation of potential incidents.
This control depends on IT.DET-02.1.
IT.DET-02.1 requires event logs to be normalised, time-synchronised and enriched so they can be correlated across systems and environments. This directly enables the monitoring of networks, systems and applications for anomalous behaviour required by Annex A 8.16, since correlation depends on consistent, accurately timed and contextualised data. IT.DET-02.1 prepares the log data, while Annex A 8.16 covers the monitoring itself and the evaluation of potential incidents.
- IT.DET-05.1Periodically review detection coverage for gaps as assets, services and architecture changeDepends on
This control depends on IT.DET-05.1.
IT.DET-05.1 requires detection coverage to be reviewed periodically to identify gaps arising from new assets, services or architectural changes. This keeps the monitoring of networks, systems and applications for anomalous behaviour required by Annex A 8.16 complete as the environment changes. IT.DET-05.1 is a periodic review activity, while Annex A 8.16 covers the monitoring itself and the evaluation of potential incidents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.