In short
ISO 27001 logging and monitoring requirements sit mainly in Annex A 8.15 Logging and 8.16 Monitoring activities of ISO/IEC 27001:2022, supported by 8.17 Clock synchronization, 5.7 Threat intelligence and 5.24 to 5.28 on incident management. In practice that means a logging policy, central log collection, protected retention, alert review and recorded incident handling.
Get a quote for ISO 27001 logging and monitoring
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
The controls that cover logging and monitoring
ISO/IEC 27001:2022 is the current edition of the standard. Its Annex A lists 93 controls, and you decide which apply through your risk assessment and Statement of Applicability. Logging and monitoring touch several of them. We use the control titles only here; read the standard itself, or ISO/IEC 27002:2022 for implementation guidance, for the detail.
| Annex A control | Title | What it means for logging and monitoring |
|---|---|---|
| 8.15 | Logging | Keep records of user activity, errors and security events, protect them and review them. In the 2013 edition this was spread across A.12.4.1 to A.12.4.3 |
| 8.16 | Monitoring activities | Look for unusual behaviour across your systems and act on what you find. New in the 2022 edition |
| 8.17 | Clock synchronization | Keep system clocks aligned so events from different sources can be put in order |
| 5.7 | Threat intelligence | Collect and use information about threats, which feeds detection rules and hunting |
| 5.24 to 5.28 | Incident management planning and preparation; assessment and decision on events; response; learning from incidents; collection of evidence | Turn alerts into decisions, respond consistently, learn and keep evidence |
| 6.8 | Information security event reporting | Give people a route to report suspicious events |
| 8.8 | Management of technical vulnerabilities | Find and fix weaknesses before they are exploited |
| 5.22 | Monitoring, review and change management of supplier services | Oversee the providers, including any MSSP, that run part of your security |
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
What a logging and monitoring policy should cover
Auditors usually start with your policy and then test whether reality matches it. A workable logging and monitoring policy answers these questions:
- Which sources are logged: sign-ins and identity changes, administrator actions, endpoint and server security events, firewall and VPN activity, email security events and cloud audit logs such as Microsoft 365
- Where logs go: a central platform rather than scattered device logs that roll over
- How long they are kept: a retention period justified by your risk assessment, contracts and legal obligations
- How they are protected: access restricted, changes prevented or detectable, and administrators unable to quietly delete their own activity
- Who reviews them and how: automated detection plus human triage, with a defined route for anything that looks like an incident
- Time sources: every system using the same reliable time so timelines can be rebuilt
- Personal data: logs often contain it, so they fall under UK GDPR as well
The policy is yours to write and approve. The services below are how you make it real without building a security operations team.
How SIEM and MDR services produce the evidence
A managed service is one of the most direct ways to meet 8.15 and 8.16 with evidence an auditor can follow.
For 8.15 Logging, a SIEM as a service collects logs centrally and keeps them for a period you choose. Options we supply include Sophos Next-Gen SIEM, with 13 months of retention as standard and longer options; CrowdStrike Falcon Next-Gen SIEM, where the add-on we supply includes 365-day retention; Todyl SIEM, with retention tiers; Blackpoint CompassOne Standard, which includes SIEM with 365 days of log storage; and Splunk Enterprise Security. If you already run Microsoft Sentinel, we can work with it.
For 8.16 Monitoring activities, a vendor managed SOC or MDR service watches alerts 24/7, investigates them and takes the response actions you have approved. Sophos MDR, for example, keeps 90 days of device data with a one-year storage option, and lets you choose whether its analysts act for you, work with you or only notify you.
For 5.24 to 5.28 Incident management, vendor investigations are written up as cases with a timeline, actions and recommendations, which is the kind of record auditors ask for. An incident response retainer covers serious incidents, and evidence collection, beyond the day-to-day.
For 5.7 Threat intelligence, vendor SOCs draw on their own research teams, such as Cisco Talos and Check Point Research, so your detection benefits from intelligence you would struggle to gather yourself.
Forever Systems does not run its own security operations centre. The 24/7 monitoring and response comes from the vendor services we resell, such as Sophos MDR, Check Point MDR or WatchGuard MDR; we recommend one, set it up, manage it and handle escalation with you.
Is ISO 27001 logging and monitoring the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Preparing for an ISO 27001 audit
- List your log sources and check each one actually reaches the central platform.
- Set and document retention, then confirm the platform is configured to match.
- Make sure clocks on servers, network devices and cloud services use a consistent time source.
- Keep a sample of alerts showing triage, decisions and closure, including false positives.
- Keep incident records with timelines, actions, lessons learned and evidence handling.
- Record how you oversee your MSSP under 5.22: service reviews, reports received and actions agreed.
We can supply service reports and walk through them with you before an audit. We are not a certification body and cannot certify you; certification is carried out by an independent certification body you appoint.
ISO 27001 compared with other UK requirements
Many organisations pursue ISO 27001 alongside other schemes. Cyber Essentials vs ISO 27001 explains how the two certifications differ: Cyber Essentials checks five technical controls and has no monitoring requirement, while ISO 27001 covers the whole management system. The logging and monitoring you build for ISO 27001 also supports the NIS Regulations, the DSPT and FCA operational resilience, so it is rarely wasted effort. Staff awareness, which ISO 27001 also expects, is covered by ISO 27001 awareness training.
Talk to us
We can review your logging and monitoring against your ISO 27001 scope, recommend SIEM and MDR options that fit your tools and retention needs, set them up and manage them. Responsibilities and reporting are confirmed at quote, and pricing depends on users, devices or data volumes, so ask us for a quote.
Contact us to close the logging and monitoring gaps before your next audit.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What are the ISO 27001 logging requirements?
In ISO/IEC 27001:2022 the main control is Annex A 8.15 Logging, which covers creating, protecting and reviewing records of user activity, errors and security events. It works with 8.16 Monitoring activities and 8.17 Clock synchronization. The standard and ISO/IEC 27002 give the detail.
What is ISO 27001 control 8.16?
Annex A 8.16 Monitoring activities is a control new in the 2022 edition. In short, it is about watching for unusual behaviour across your systems and acting on what could be an incident, which is what a SOC or MDR service does.
How long should logs be kept for ISO 27001?
The standard does not set a single period. You choose retention through your risk assessment, taking account of contracts, legal obligations and how far back you need to investigate, then document and apply it.
Does ISO 27001 require a SIEM?
No specific tool is required. In practice a SIEM or a managed detection service is the usual way to collect, protect, analyse and monitor logs at scale and to show auditors the evidence.
Can an MSSP help with ISO 27001?
Yes, by providing logging, monitoring and incident handling and the reports that evidence them. The management system, risk assessment and certification remain yours, and certification is done by an independent certification body.
Still have a question about ISO 27001 logging and monitoring?
Ask us and a member of our team will reply by email.