Monitoring activities

Plain-language summary

New in 2022: watching networks, systems and applications for behaviour that departs from normal, and acting on what you find — so that an intrusion, a compromised account or a misbehaving system is noticed and evaluated as a possible incident, not discovered months later.

What the clause is really asking

Logging records what happened; monitoring means someone, or something, looks and acts. The control asks you to establish a baseline of normal behaviour for networks, systems and applications, watch for departures from it, and evaluate anomalies as potential information security incidents. What to watch is risk-based: inbound and outbound network traffic, sign-ins and access to critical systems, privileged activity, security tool alerts, unusual resource use, unexpected processes, connections to known malicious addresses. Monitoring can be continuous or periodic, but it must match the risk, and thresholds should be tuned so that real signals are not buried in noise. Threat intelligence sharpens what you look for. The common misunderstanding is that a SIEM licence or a dashboard equals monitoring. If nobody responds to alerts outside office hours, attackers often choose those hours. For most 50–500-person organisations a managed detection and response service is the realistic route, with a clear agreement on what is watched and when they call you. Timely alerts are also what lets you make the POPIA section 22 notification decision quickly.

What auditors look for

Auditors ask what is monitored, by whom and when — including nights, weekends and public holidays. They ask for the monitoring scope or the managed service's statement of work, then for a sample of alerts from the last quarter, and trace one to its outcome: triaged, escalated, closed, or raised as an incident. They check whether baselines and thresholds have ever been tuned. They ask how alerts from cloud services, endpoint protection and the firewall reach the same place. The hard question: what was the last genuine anomaly you detected yourselves, and how long did it take to respond?

Typical evidence

Monitoring scope defining systems, events and coverage hours; SIEM or managed detection service configuration and contract; documented baselines and alert thresholds; alert and triage records with outcomes; escalation procedure with contacts; records of tuning changes; threat intelligence sources in use; periodic reports from the monitoring provider; links from escalated alerts to incident records.

How to comply — recommendations

Decide your monitoring scope from the risk assessment: identity sign-ins, email, endpoints, the firewall and the systems holding your most sensitive information. Choose a delivery model you can sustain — for most organisations of this size, a managed detection and response service or your MSP's security operations centre, covering out-of-hours. Put the scope, response times and escalation contacts in the contract, and test the escalation by calling the number. Switch on built-in alerting in your identity and cloud platforms for impossible travel, mass downloads, new inbox forwarding rules and privilege changes. Hold a monthly alert review with the provider and tune out noise. Link every escalated alert to your incident procedure and the POPIA section 22 assessment.

Common nonconformities

Logs collected but not monitored; no defined baseline of normal behaviour or alert thresholds; alerts unreviewed outside office hours; monitoring contract with no defined scope or response times; cloud and identity platform alerts ignored; alerts closed without recorded triage; no link between monitoring and incident management; thresholds never tuned.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.