ISO 27001 A.8.16 Monitoring Activities: Meeting It with SIEM

Meeting A.8.16 with SIEM

• Cover critical systems in scope with monitored telemetry
• Define use cases / detections tied to threats in your risk assessment
• Evidence triage, escalation, and closure

Frequently Asked Questions

What is the official title of A.8.16?

Monitoring activities.

Is a SIEM mandatory by name?

No. The control requires monitoring; SIEM is a common implementation pattern for scale and evidence.

How does this differ from A.8.15?

A.8.15 focuses on producing/protecting/analysing logs; A.8.16 focuses on monitoring for anomalous behaviour and potential incidents.

Related ISO 27001 Resources

ISO 27001 hub · 93 controls · SoA · CSA · A.8.15 · ThreatHawk