A.8.16 Technological
Monitoring activities
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (11)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AU-6mostlyaligns with — Both require review and analysis of monitoring records to identify security events and support incident response and improvement activities.
- SI-4mostlyaligns with — Both controls establish continuous monitoring against a defined baseline to detect anomalies, unauthorized access, and malicious activity, with alert generation and response procedures.
- AU-12partialaligns with — Both address the generation of audit records from network, system, and application sources to enable detection and investigation of security-relevant events.
- AU-2partialaligns with — Both specify the types of events and activities that must be captured by the monitoring system to support security objectives.
- CA-7partialaligns with — Both emphasize ongoing monitoring of security controls and system behavior to maintain situational awareness and support risk management.
Aligned NIST CSF 2.0 outcomes (13)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- DE.AE-02mostlyaligns with — Establishing a normal-behavior baseline and analyzing deviations from it provides the analytical foundation the CSF outcome seeks for understanding activities associated with potentially adverse events.
- DE.CM-01mostlycovers — The ISO control's emphasis on continuous, baseline-driven monitoring of network traffic, system activity, and security-tool logs directly fulfills the CSF outcome of monitoring networks and services to detect potentially adverse events.
- DE.CM-03mostlycovers — The ISO control's focus on tracking user access patterns, authentication attempts, and deviations from normal behavior aligns with the CSF outcome of monitoring personnel activity and technology usage.
- DE.CM-09mostlycovers — By requiring monitoring of hardware/software runtime behavior, resource utilization, and code integrity, the ISO control satisfies the CSF outcome of monitoring computing environments and their data for adverse events.
- DE.AE-06partialaligns with — The ISO control's automated alerting and communication of abnormal events to relevant personnel fulfills the CSF outcome of providing adverse-event information to authorized staff and tools.
- DE.AE-07partialaligns with — The ISO control integrates threat signatures, malicious IP lists, and known attack patterns into monitoring, which supports the CSF outcome of incorporating cyber threat intelligence into event analysis.
- PR.PS-04partialaligns with — Requiring generation and retention of event logs from systems, applications, and security tools directly supports the CSF outcome of making log records available for continuous monitoring.
Related OWASP ASVS 5.0 requirements (13)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V16.2.1mostlyaligns with — The ISO control's requirement to capture detailed event metadata (who, what, when, where) for security-relevant activities directly supports the ASVS mandate that every log entry contain sufficient context for later investigation.
- V16.3.1mostlyaligns with — Both documents require logging of all authentication attempts (successful and unsuccessful) together with contextual metadata, enabling detection and forensic review of credential-based attacks.
- V16.3.2mostlyaligns with — The ISO guidance to log successful and unsuccessful attempts to access protected resources aligns with the ASVS requirement to record failed (and, at L3, all) authorization decisions.
- V16.3.3partialaligns with — ISO's mandate to log attempts to bypass security controls and to monitor against a baseline of expected behaviour partially satisfies the ASVS requirement to log both the documented security events and any bypass attempts.
- V16.4.2partialaligns with — The ISO control's emphasis on protecting monitoring records for defined retention periods and ensuring they cannot be tampered with aligns with the ASVS requirement that logs be protected from unauthorized access and modification.
- V16.4.3partialaligns with — ISO's call for continuous, real-time or periodic monitoring with redundant alert paths and timely incident response partially maps to the ASVS requirement to transmit logs securely to a separate system for analysis and escalation.
- V2.4.1partialaligns with — The ISO requirement to detect anomalous resource usage and excessive or unusual access patterns supports the ASVS objective of implementing anti-automation controls that protect against data exfiltration via high-frequency calls.
Related weaknesses / CWE (46)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1050→MCWE-117→PCWE-1250←P →PCWE-1320←P →PCWE-200→PCWE-202←P →PCWE-222←PCWE-223←P →PCWE-284→PCWE-360←P →PCWE-385←P →PCWE-390←P →PCWE-392←PCWE-400→MCWE-406→MCWE-407←P →PCWE-409→PCWE-506→PCWE-507→PCWE-509→PCWE-511→PCWE-515←P →PCWE-69←P →PCWE-74→PCWE-754→PCWE-755←P →PCWE-770→MCWE-778→PCWE-779→PCWE-807→PCWE-91→PCWE-912→P
Why these map — AI rationale (under review)
- CWE-1050mostlyfinds — Monitoring can alert on resource abuse but does not eliminate the coding flaw.
- CWE-400mostlyfinds — Resource-utilization monitoring and alerting on bottlenecks or overloads limits the impact of denial-of-service or resource-exhaustion attacks.
- CWE-406mostlyfinds — Monitoring activities can detect anomalous traffic volumes, yet detection alone does not enforce control.
- CWE-770mostlyfinds — Baseline comparison of CPU, memory and bandwidth usage helps surface uncontrolled resource allocations before they cause service degradation.
- CWE-117partialfinds — Monitoring activities rely on trustworthy logs but do not ensure log message integrity.
- CWE-1250partialfinds — Monitoring can detect inconsistencies after they occur but does not prevent them by design.
- CWE-1320partialfinds — Monitoring activities can detect disabled or suppressed outbound alerts.
- CWE-200partialfinds — Continuous monitoring of access attempts and anomalous behaviour makes it harder for an attacker to keep unauthorized disclosure of sensitive data undetected.
- CWE-202partialfinds — Monitoring can identify anomalous query patterns indicative of inference attacks.
- CWE-223partialfinds — Monitoring activities rely on the very information whose absence defines the weakness.
- CWE-284partialfinds — Detection of unauthorized access attempts and deviations from expected access patterns reduces the window in which improper access control can be exploited without notice.
- CWE-360partialfinds — Monitoring activities may detect anomalies in event data but do not guarantee the trustworthiness of the source.
- CWE-385partialfinds — Continuous monitoring may detect timing-based exfiltration but does not eliminate the channel itself.
- CWE-390partialfinds — Monitoring activities can detect errors, yet without defined response procedures the weakness persists.
- CWE-407partialfinds — Monitoring activities can identify anomalous resource consumption indicative of algorithmic complexity attacks.
- CWE-409partialfinds — Monitoring can detect anomalous resource usage but does not prevent the weakness.
- CWE-506partialfinds — Checks that executed code has not been tampered with and monitoring for malware-associated activity reduce the likelihood that hidden malicious code remains active.
- CWE-507partialfinds — Monitoring activities can identify Trojan Horse behavior but do not stop its introduction.
- CWE-509partialfinds — Monitoring activities enable early detection of replicating malicious code.
- CWE-511partialfinds — Monitoring activities may detect anomalous behavior triggered by a logic/time bomb.
- CWE-515partialfinds — Monitoring can detect covert storage but does not eliminate the underlying weakness.
- CWE-69partialfinds — Monitoring activities can flag anomalous ADS usage, providing partial mitigation through detection rather than prevention.
- CWE-74partialfinds — Monitoring activities can identify active injection attacks after they occur.
- CWE-754partialfinds — Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.
- CWE-755partialfinds — Monitoring can surface unhandled exceptions but does not enforce proper handling.
- CWE-778partialfinds — Mandating retention of monitoring records and real-time or periodic logging directly counters insufficient logging by ensuring security-relevant events are captured.
- CWE-779partialprevents — Monitoring activities can detect excessive logging but do not prescribe how much data should be logged.
- CWE-807partialfinds — Monitoring can detect exploitation but does not stop the underlying weakness.
- CWE-91partialfinds — Monitoring can detect exploitation but provides no preventive control over XML handling.
- CWE-912partialfinds — Monitoring activities can detect anomalous behavior from hidden functions but do not eliminate the weakness.
- CWE-222nonenone — Monitoring activities rely on complete event data; truncation would impair detection and analysis.
- CWE-392nonenone — Monitoring activities can detect missing error reporting by observing abnormal system behavior.
- CWE-645nonenone — Monitoring can detect excessive lockouts but does not define or enforce appropriate lockout parameters.
Mitigated MITRE ATT&CK techniques (8)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1021mostlydetects — Detection of anomalous remote access patterns and unauthorized attempts to protected resources can reveal lateral movement via remote services.
- T1046mostlydetects — Detection of unauthorized scanning of business applications, systems and networks limits the adversary's ability to discover network services without triggering alerts.
- T1059mostlydetects — Monitoring for anomalous command execution, process injection and deviations from standard protocol use can flag unauthorized use of command-line interpreters.
- T1078mostlydetects — Continuous monitoring of access attempts against a baseline of normal user behaviour and locations directly reduces the stealth value of using valid accounts for unauthorized activity.
- T1110mostlydetects — Baseline monitoring of access frequency and failed login attempts helps identify brute-force or password-spraying attempts against accounts.
- T1055partialdetects — Monitoring for process injection and other unusual system behaviour provides visibility into stealthy code execution techniques.
- T1070partialdetects — Logging and real-time monitoring of system and network activity make it harder for adversaries to clear traces of their presence without detection.
- T1105partialdetects — Monitoring inbound and outbound traffic for signatures associated with malware or known malicious domains can detect and alert on unauthorized tool transfers.
Prevented OWASP Web Top 10 (2025) risks (5)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A09mostlyfinds — Continuous collection, baselining, and real-time alerting on security-relevant events directly supplies the visibility and response capability that logging and alerting failures otherwise leave absent.
- A01partialfinds — Detection of unauthorized access attempts and anomalous privilege use provides an essential backstop that limits the impact when access-control enforcement is bypassed or misapplied.
- A02partialfinds — Monitoring of configuration files, resource utilization, and deviation from expected behavior surfaces misconfigurations that would otherwise remain undetected until exploited.
- A05partialfinds — Signature and behavioral detection of known attack patterns such as buffer overflows and injection attempts reduces the window in which injection flaws can be leveraged successfully.
- A07partialfinds — Tracking of successful and failed authentication events against a user baseline helps surface credential abuse or authentication bypass that would otherwise go unnoticed.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.