[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-16":3},{"item":4,"lessons":16,"controls":42,"related":70},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-16","Annex A 8.16","ISO\u002FIEC 27001:2022 Annex A 8.16: Monitoring activities",6,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects networks, systems and applications to be monitored for anomalous behaviour, with appropriate action taken to evaluate potential information security incidents. The purpose is to detect anomalous behaviour and potential incidents early.\n\n**In practice.** Good practice means establishing a baseline of normal behaviour, collecting relevant logs and telemetry, and using tools such as a SIEM or detection platform to raise alerts on anomalies. Alerts are triaged by people with defined responsibilities and escalated to incident management. Auditors look for monitoring scope, detection rules, alert handling records and evidence of tuning.\n\n**Common gaps.** Common gaps are monitoring that excludes cloud services, alerts nobody reviews out of hours and detection rules never tuned or tested. Responsibilities between the internal team and a managed security provider are often unclear.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38],{"slug":19,"title":20,"published_at":21},"swedish-dpa-fines-it-provider-160k-after-cyberattack-exposes-22-million-records","Swedish DPA Fines IT Provider €160K After Cyberattack Exposes 2.2 Million Records","2026-10-08T16:21:10.231+00:00",{"slug":23,"title":24,"published_at":25},"miljdata-fined-183k-after-breach-exposes-22-million-records-due-to-poor-monitoring-and-software-vett","Miljödata Fined $183K After Breach Exposes 2.2 Million Records Due to Poor Monitoring and Software Vetting","2026-09-22T22:20:36.19+00:00",{"slug":27,"title":28,"published_at":29},"gdpr-fine-issued-after-cyberattack-exposes-inadequate-security-controls","GDPR Fine Issued After Cyberattack Exposes Inadequate Security Controls","2026-09-08T16:20:19.878+00:00",{"slug":31,"title":32,"published_at":33},"ddos-attack-disrupts-norways-government-digital-services","DDoS Attack Disrupts Norway's Government Digital Services","2026-08-25T16:20:24.163+00:00",{"slug":35,"title":36,"published_at":37},"orange-romania-fined-100k-for-breach-tied-to-poor-monitoring-and-vulnerability-testing","Orange Romania Fined €100K for Breach Tied to Poor Monitoring and Vulnerability Testing","2026-07-21T18:20:38.62+00:00",{"slug":39,"title":40,"published_at":41},"agentic-ai-closing-the-gap-between-alert-fatigue-and-effective-threat-response","Agentic AI: Closing the Gap Between Alert Fatigue and Effective Threat Response","2026-06-19T14:21:40.516+00:00",[43,48,52,57,61,66],{"slug":44,"name":45,"problem":46,"stories":47},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":49,"name":50,"problem":51,"stories":47},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":53,"name":54,"problem":55,"stories":56},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":58,"name":59,"problem":60,"stories":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":62,"name":63,"problem":64,"stories":65},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",1,{"slug":67,"name":68,"problem":69,"stories":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[71,77,82,86,91,95,99,103],{"family":72,"item":73,"code":74,"title":75,"together":76},"cis","8","Control 8","Audit Log Management",4,{"family":78,"item":79,"code":80,"title":81,"together":76},"gdpr","32","Article 32","Security of processing",{"family":78,"item":83,"code":84,"title":85,"together":76},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":87,"item":88,"code":89,"title":90,"together":47},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":72,"item":92,"code":93,"title":94,"together":47},"13","Control 13","Network Monitoring and Defense",{"family":72,"item":96,"code":97,"title":98,"together":47},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":100,"code":101,"title":102,"together":47},"a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",{"family":72,"item":104,"code":105,"title":106,"together":56},"6","Control 6","Access Control Management"]