For Annex A control 8.16, "Monitoring activities", new in the 2022 edition, show what you watch, what triggers an alert, who receives it and what happened next. Alert rule exports, on call records and tickets that close alerts form the evidence chain for most software teams.
What changed in 2022
ISO/IEC 27001:2022 reorganized Annex A into 93 controls, and several were added. Sources that list the additions include 8.16 "Monitoring activities" among them. Logging, covered by 8.15, is about recording events. Monitoring is about looking at them and acting.
The difference matters for evidence. A log store full of events proves you collect. It does not prove anyone watches. Assessors tend to look for the link between a signal, a person and an outcome.
The chain of evidence
| Link | Artifact |
|---|---|
| What is watched | List of monitored systems and the signals per system |
| What triggers action | Alert rule export with thresholds |
| Who is told | On call schedule or alert routing configuration |
| What they did | Ticket or incident record per alert |
| How rules improve | Review notes after noisy or missed alerts |
For software supply chain signals, add pipeline events such as failed gate checks, new advisories on shipped components and unexpected changes to build definitions. These are monitoring in the same sense as a server alert.
Steps to document it without overbuilding
- List your systems by importance and write the two or three signals that matter most for each.
- Export the alert rules and store them with a date.
- Confirm each alert has an owner and a route.
- Pick five alerts from the last quarter and trace each to a ticket. Save the trace.
- Note any alert that fired and went nowhere, then fix the routing.
- Review thresholds after each incident and keep the notes.
This sample trace is the single most persuasive artifact you can hold, because it shows the whole chain on real events.
Mistakes that weaken the story
Alert fatigue, where so many alerts fire that nobody reads them. Dashboards that nobody opens. Rules that were set up once and never reviewed. Monitoring of production only, while build systems and source hosts go unwatched even though they can change what ships.
If a signal is too noisy to act on, say so and tune it. A tuned list of fewer alerts with clear owners reads better than a long list of ignored ones.
Try it yourself
Open the continuous monitoring demo and watch how a new advisory against a shipped component raises a finding. That raise, route and follow up cycle is the shape of monitoring evidence.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers dependency scanning, reachability analysis and compliance and evidence automation, which can produce dated finding records and framework mapped evidence. Fix PRs are off by default, with every category on Manual. You can try the free scan at gold.safeguard.sh/scan. Mapping is a starting point, not a verdict on compliance.
Quick check
How is monitoring different from logging?
Logging records events. Monitoring means reviewing them, or alerting on them, and responding. Evidence for monitoring needs the review and the response, not just the log store.
Do we need a security operations center?
The control title does not say so. Scale the approach to your size and risk, and document who watches what and how they are alerted.
Sources
- ISO 27001 Annex A controls list, Security Compliance Guide
- ISO 27001 Annex A controls explained, Glocert International
Last reviewed: 19 October 2026.
