Monitoring activities

frameworkISO/IEC 27001:2022 sectionA.8 Technological controls csf 2.0DE.AE-03 DE.CM-01 DE.CM-03 DE.CM-06 DE.CM-09 ID.RA-02 ID.RA-03 topicsCont. Monitoring, Intrusion Detection, Anomaly Detection, SIEM / SOC, Insider Threat frameworks7 5 0

Official text · not licensableTitle: Monitoring activities. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.8.16 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.AE-02 DE.AE-03 DE.AE-04 DE.AE-06 DE.AE-08 DE.CM-01 DE.CM-03 DE.CM-09 GV.RR-04	Potentially adverse events are analyzed to better understand associated activities; Information is correlated from multiple sources…	Crosswalk	Same topic: Intrusion Detection, Anomaly Detection, SIEM / SOC, Cont. Monitoring, Insider Threat 3 loosely related (not mappings) DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-06: related, not a mapping ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources Loosely related Only shares CSF ID.RA-02: related, not a mapping ID.RA-03 Internal and external threats to the organization are identified and recorded Loosely related Only shares CSF ID.RA-03: related, not a mapping
CIS v8.1	CIS 8.11 CIS 13.1 CIS 8.9 CIS 13.2 CIS 13.3 CIS 13.6 CIS 13.7 CIS 13.8 CIS 13.11	Conduct Audit Log Reviews; Centralize Security Event Alerting…	Crosswalk	Same topic: Anomaly Detection, Cont. Monitoring, SIEM / SOC, Intrusion Detection 31 loosely related (not mappings) CIS 10.7 Use Behavior-Based Anti-Malware Software Loosely related Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 2.6 Allowlist Authorized Libraries Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 2.7 Allowlist Authorized Scripts Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 3.14 Log Sensitive Data Access Loosely related Only shares CSF DE.AE-03: related, not a mapping CIS 4.9 Configure Trusted DNS Servers on Enterprise Assets Loosely related Only shares CSF DE.CM-01: related, not a mapping …and 23 more in the downloads
SOC 2	CC7.2 CC7.3	Monitoring system components for anomalies; Evaluating security events to determine if they are incidents	Editorial	Same topic: Cont. Monitoring, Intrusion Detection, Anomaly Detection, SIEM / SOC (editorial pick) 6 loosely related (not mappings) CC3.2 Risk identification and analysis Loosely related Only shares CSF ID.RA-03: related, not a mapping CC3.3 Considering the potential for fraud Loosely related Only shares CSF ID.RA-03: related, not a mapping CC3.4 Identifying and assessing significant changes Loosely related Only shares CSF ID.RA-03: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF DE.CM-01: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF DE.CM-06: related, not a mapping
PCI DSS	10.2.1 10.4.1 12.7.1 10.4.1.1 11.5.1	Audit logs enabled and active; Security event and critical logs reviewed daily…	Crosswalk	Same topic: Insider Threat, Cont. Monitoring, SIEM / SOC, Anomaly Detection, Intrusion Detection 19 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping 5.2.1 Anti-malware deployed on system components Loosely related Only shares CSF DE.CM-09: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF DE.CM-09: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.CM-09: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Loosely related Only shares CSF DE.CM-06: related, not a mapping 8.2.2 Shared or generic accounts only by documented exception Loosely related Only shares CSF DE.CM-03: related, not a mapping 10.3.3 Logs promptly backed up to a central server Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 11 more in the downloads
CMMC	AU.L2-3.3.5 SI.L2-3.14.6 SI.L2-3.14.7 AT.L2-3.2.3 AU.L2-3.3.2 PS.L2-3.9.1	Audit Correlation; Monitor Communications for Attacks…	Crosswalk	Same topic: SIEM / SOC, Cont. Monitoring, Intrusion Detection, Anomaly Detection, Insider Threat 20 loosely related (not mappings) CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-06…: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-06…: related, not a mapping AU.L2-3.3.3 Event Review Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping AC.L2-3.1.1 Authorized Access Control Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping CM.L2-3.4.3 System Change Management Loosely related Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 12 more in the downloads
800-53	AC-2(12)AU-6 AU-6(3)AU-13 CA-7 IR-5 SI-4 PM-12 AC-17 IR-4 MA-4 PE-6 SC-7	Account Monitoring for Atypical Usage; Audit Record Review, Analysis, and Reporting…	Crosswalk	Same topic: Insider Threat, Anomaly Detection, SIEM / SOC, Cont. Monitoring, Intrusion Detection NIST SP 800-53 → ISO 27001 mapping 25 loosely related (not mappings) AU-12 Audit Record Generation Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping PM-16 Threat Awareness Program Loosely related Only shares CSF DE.AE-03, ID.RA-02, ID.RA-03: related, not a mapping AC-2 Account Management Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping CM-3 Configuration Change Control Loosely related Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping CM-10 Software Usage Restrictions Loosely related Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping CM-11 User-installed Software Loosely related Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping SI-5 Security Alerts, Advisories, and Directives Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 17 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C)	Information System Activity Review; Workforce Clearance Procedure…	Crosswalk	Same topic: Cont. Monitoring, SIEM / SOC, Insider Threat 27 loosely related (not mappings) §164.308(a)(8) Evaluation Loosely related Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-06…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping §164.312(a)(2)(i) Unique User Identification Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping …and 19 more in the downloads
GDPR	Art.29 Art.32(4)	Processing under the authority of the controller or processor; Security of processing	Editorial	Same topic: Insider Threat (editorial pick) 4 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF DE.CM-06: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF DE.CM-06: related, not a mapping Art.35(1) Data protection impact assessment Loosely related Only shares CSF ID.RA-03: related, not a mapping Art.35(7) Data protection impact assessment Loosely related Only shares CSF ID.RA-03: related, not a mapping
NIS2	3.2 3.4 10.2 10.4 6.7	Monitoring and logging; Event assessment and classification…	Crosswalk	Same topic: Cont. Monitoring, Intrusion Detection, SIEM / SOC, Anomaly Detection, Insider Threat ENISA NIS2 → ISO 27001 mapping 6 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-02: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06: related, not a mapping
Essential Eight	ISM-0109 ISM-1228 ISM-1906 ISM-1907	Event logs from workstations are analysed in a timely manner to detect cyber security…; Cyber security events are analysed in a timely manner to identify cyber security incidents…	Editorial	Same topic: Cont. Monitoring, Anomaly Detection, SIEM / SOC (editorial pick) 11 loosely related (not mappings) ISM-0843 Application control is implemented on workstations Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1490 Application control is implemented on internet-facing servers Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF DE.AE-03: related, not a mapping ISM-1544 Microsoft’s recommended application blocklist is implemented Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Loosely related Only shares CSF DE.AE-03: related, not a mapping ISM-1657 Application control restricts the execution of executables, libraries, scripts… Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1660 Allowed and blocked application control events are centrally logged Loosely related Only shares CSF DE.AE-03: related, not a mapping …and 3 more in the downloads
DORA	Art.9(1)Art.10(1)Art.10(2)Art.10(3)	Protection and prevention; Detection…	Editorial	Same topic: Cont. Monitoring, Intrusion Detection, Anomaly Detection, SIEM / SOC, Insider Threat (editorial pick) 11 loosely related (not mappings) Art.8(2) Identification Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Art.13(1) Learning and evolving Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Art.8(3) Identification Loosely related Only shares CSF ID.RA-03: related, not a mapping Art.8(7) Identification Loosely related Only shares CSF ID.RA-03: related, not a mapping Art.28(3) General principles Loosely related Only shares CSF DE.CM-06: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF DE.CM-06: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 3 more in the downloads
CPS 234	Para 23	Detect and respond to incidents in a timely manner	Editorial	Same topic: Intrusion Detection (editorial pick) 6 loosely related (not mappings) Para 17 Keep capability current as threats and vulnerabilities change Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Para 16 Assess third parties' information security capability Loosely related Only shares CSF DE.CM-06: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF ID.RA-03: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF DE.CM-06: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF DE.CM-06: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF DE.CM-06: related, not a mapping
Cyber Essentials	CE 5	Malware protection	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.