ISO 27001:2022 introduced A.8.16 as a new control with no direct equivalent in the 2013 version. The control requires that networks, systems, and applications be monitored for anomalous behaviour and that appropriate actions be taken when anomalies are detected. The 2022 revision’s addition of A.8.16 reflects a deliberate shift in the standard’s monitoring posture: from reactive log review to proactive anomaly detection.
Organisations certified under ISO 27001:2013 and transitioning to the 2022 version face a specific gap assessment for A.8.16. The 2013 standard’s monitoring requirements under A.12.4 covered log generation and protection. A.8.16 goes further by requiring that logs be actively monitored, that anomalous behaviour be detected, and that detection trigger a response. The distinction is meaningful: an organisation can fully satisfy A.8.15’s logging requirement while having no anomaly detection capability that satisfies A.8.16.
The IAM layer is where A.8.16’s monitoring requirement is most immediately actionable. Authentication events contain the signals for anomaly detection: geographic location, device identity, time of day, MFA outcome, and access patterns. A monitoring infrastructure that evaluates these signals continuously against user baselines and generates alerts when they deviate satisfies A.8.16 at the authentication layer. Building this capability requires Adaptive MFA with anomaly detection, not only authentication event logging.
This blog covers what A.8.16 specifically requires, how it differs from A.8.15, what the 2022 update means for organisations transitioning from the 2013 standard, and what IAM controls satisfy the new monitoring obligation.
A.8.16 sits within the Technological Controls theme and addresses monitoring activities as a control category.
A.8.16 requires that monitoring procedures be established and implemented to detect anomalous behaviour in networks, systems, and applications. The detection requirement is active and automated: anomalies must be identified as they occur or shortly after, not discovered during retrospective log review.
Anomalous behaviour in the IAM context includes authentication from unusual locations or devices, authentication at unusual hours, MFA failure patterns indicating credential stuffing attempts, access to systems or functions outside a user’s established pattern, and privileged session activities inconsistent with the session’s stated purpose.
The monitoring must operate continuously. A.8.16 is not satisfied by a weekly log review that examines authentication events from the previous seven days. Continuous monitoring requires automated evaluation of events against baselines as they occur, with detection and alerting that does not depend on the review schedule.
A.8.16 requires that appropriate actions be taken when anomalies are identified. The response component distinguishes A.8.16 from a passive monitoring requirement. Detected anomalies must trigger defined responses: step-up authentication challenges for authentication anomalies, session termination for suspicious privileged sessions, account suspension for account compromise indicators, or investigation workflows for ambiguous events.
The response must be proportionate to the anomaly severity. A geographic anomaly that may reflect legitimate travel warrants a step-up challenge and investigation. An impossible travel event warrants immediate account suspension. A response mechanism that treats all anomalies identically, regardless of severity, does not satisfy A.8.16’s appropriate actions requirement.
A.8.16 compliance requires evidence that monitoring is operating. This includes monitoring infrastructure configuration documentation, anomaly alert records demonstrating detection events throughout the certification period, investigation records showing that alerts were acted upon, and response records documenting the actions taken for each anomaly.
Certification auditors examining A.8.16 will look for evidence of active monitoring, not only for the existence of a monitoring policy. The operating effectiveness standard requires that detection events occurred throughout the certification period and that each was responded to appropriately.
A.8.15 and A.8.16 are complementary but distinct controls. Understanding the distinction is necessary for organisations assessing their gap against the 2022 standard.
A.8.15 requires that logs recording user activities, exceptions, faults, and security events be produced, kept, and regularly reviewed. The control focuses on what is recorded and how those records are protected and retained. An organisation satisfies A.8.15 by deploying comprehensive logging, protecting logs against tampering, retaining them for defined periods, and reviewing them regularly.
Regular review under A.8.15 does not require automated anomaly detection. A scheduled log review process where an administrator examines logs on a defined cadence satisfies A.8.15’s review requirement. The review is systematic but not necessarily automated.
A.8.16 requires that monitoring detect anomalous behaviour and trigger appropriate responses. This is a real-time or near-real-time requirement. The monitoring must surface anomalies without waiting for a scheduled review cycle. Automated baseline comparison and alert generation are what A.8.16 requires that A.8.15 does not.
An organisation that has comprehensive logging under A.8.15 but no automated anomaly detection has a gap in A.8.16. The logs exist and are reviewed, but the review does not satisfy the continuous detection and alert generation requirement.
Organisations certified under ISO 27001:2013 satisfied A.12.4’s logging and monitoring requirements without needing automated anomaly detection. The 2022 transition to A.8.16 requires assessing whether current monitoring infrastructure includes automated detection or only systematic log review. If only the latter, deploying anomaly detection capability is the gap that must be closed for 2022 certification.
A.8.16’s addition to the 2022 standard has specific implications for the IAM stack components that organisations deploy for compliance.
Adaptive MFA with AI-powered anomaly detection satisfies A.8.16 at the authentication layer. Every authentication event is evaluated against the user’s behavioural baseline. Deviations trigger step-up authentication challenges and generate anomaly detection events in the audit trail. This is continuous, automated monitoring with proportionate response: the definition of what A.8.16 requires.
An organisation that deploys standard MFA, where the same second factor is applied uniformly to every authentication event, satisfies A.8.5’s authentication requirement but not A.8.16’s anomaly detection requirement. A.8.16 requires that the authentication layer evaluate each event for anomalous signals and respond proportionately. Only Adaptive MFA with baseline evaluation satisfies both A.8.5 and A.8.16 simultaneously.
Real-time privileged session monitoring through AkkuReka satisfies A.8.16 at the privileged access layer. Administrators view all active privileged sessions and can terminate sessions exhibiting anomalous behaviour. Session activity monitoring that surfaces commands or queries inconsistent with the session’s stated purpose is the privileged access equivalent of authentication anomaly detection.
Retrospective session recording through SMARTAudit Trails satisfies the evidence component of A.8.16: a complete record of privileged session activity that supports post-anomaly investigation.
SoD violation detection in the IGA rules engine satisfies A.8.16 at the access governance layer. Continuous detection of conflicting role combinations, with alert generation and remediation workflows, is anomalous access pattern detection applied to entitlement combinations rather than authentication events.
Access review anomaly detection, where the review process surfaces users whose access scope has deviated significantly from their peers in the same role, extends A.8.16’s anomaly detection to the entitlement layer.
For organisations transitioning from ISO 27001:2013 certification, implementing A.8.16 can be staged to prioritise the highest-risk monitoring scenarios first.
The first priority is deploying Adaptive MFA with baseline evaluation for all authentication events to in-scope systems. This is the highest-impact A.8.16 implementation because authentication is the first layer where anomalies can be detected and the step-up response prevents rather than merely records suspicious access.
Authentication anomaly detection covers geographic anomalies, impossible travel, device anomalies, time-of-day deviations, and MFA failure pattern analysis. Each anomaly type requires a baseline model and a configured response threshold.
The second priority is real-time monitoring of active privileged sessions through PAM. This extends A.8.16’s anomaly detection to the post-authentication layer, covering what privileged users do during sessions rather than only how they authenticate.
Real-time monitoring with termination capability addresses the highest-impact privileged access scenarios: a compromised administrator account or an insider threat actor would be visible in the active session monitor and terminable before significant damage occurs.
The third priority is SoD violation detection and access pattern analysis at the entitlement layer. This extends A.8.16’s monitoring to the access governance domain, detecting anomalous access combinations that may indicate fraud enablement or insider threat preparation.
Access pattern analysis, identifying users whose entitlement scope has grown significantly beyond their peer group, complements the authentication-layer and session-layer detection with a longer-term perspective on access accumulation.
Does your monitoring infrastructure evaluate authentication events against user-specific baselines and generate alerts when anomalies are detected, or does it log events for periodic review without automated anomaly detection?
When transitioning from ISO 27001:2013 certification to the 2022 standard, have you assessed whether your current monitoring infrastructure satisfies A.8.16’s automated detection requirement or only A.8.15’s logging and review requirement?
For anomaly detection events generated in the last 12 months, is there a documented response record for each event showing investigation and resolution, or do alerts exist without corresponding investigation evidence?
Does your privileged session monitoring provide real-time visibility with termination capability, or does monitoring consist only of retrospective review of session recordings after sessions close?
Can you demonstrate to a certification auditor that A.8.16’s anomaly detection has been operating continuously throughout the certification period, with detection events and response records spanning the full period?
See how Akku’s Adaptive MFA and privileged session monitoring address ISO 27001:2022 A.8.16 continuous monitoring requirements across authentication, session, and access governance layers.
Book a conversation with the Akku team to assess your current monitoring posture against ISO 27001:2022 A.8.16 certification requirements.
What specifically did ISO 27001:2022 add with A.8.16 that was not in the 2013 standard?
ISO 27001:2013 included A.12.4 covering monitoring system use, which required logging of user activities, exceptions, and security events, and protection of logging information. The 2022 revision reorganised these requirements into A.8.15 and added A.8.16 as a new control requiring active monitoring for anomalous behaviour with appropriate response actions. The key addition in A.8.16 is the anomaly detection and response requirement: not only must events be logged and reviewed, but the monitoring infrastructure must detect anomalies automatically and trigger responses. This moves the standard from systematic log review to continuous automated detection, reflecting the evolution of security monitoring practices since 2013.
Does A.8.16 require a dedicated security information and event management platform?
A.8.16 requires that networks, systems, and applications be monitored for anomalous behaviour. It does not prescribe specific technologies. A SIEM platform is one way to implement A.8.16, but it is not the only way. For organisations whose primary anomaly detection concern is at the IAM layer, Adaptive MFA with anomaly detection, privileged session monitoring, and SoD violation detection collectively satisfy A.8.16 without requiring a full SIEM deployment. Organisations with broader monitoring requirements covering network traffic, endpoint behaviour, and application events may benefit from a SIEM. The A.8.16 requirement is technology-neutral: what matters is that anomalous behaviour is detected and that appropriate actions are taken.
How does the transition timeline from ISO 27001:2013 to 2022 affect the A.8.16 gap?
ISO published ISO 27001:2022 in October 2022. The transition period allows organisations certified under the 2013 standard to transition to the 2022 standard by October 2025. Organisations that have not yet transitioned should assess their A.8.16 gap as part of their transition planning. The gap assessment should determine whether current monitoring infrastructure includes automated anomaly detection or only systematic log review. Where a gap exists, the time to close it is before the transition audit, not during it. Deploying Adaptive MFA with anomaly detection and establishing the investigation workflow and response documentation before the transition audit ensures A.8.16 evidence covers the required certification period.
What does A.8.16 require for response documentation, and how detailed must investigation records be?
A.8.16 requires that appropriate actions be taken when anomalies are detected. The response documentation must demonstrate that actions were proportionate to the anomaly severity and that investigations were conducted. For a geographic anomaly that resolved as a legitimate business trip, the investigation record might be brief: the alert was reviewed, the user confirmed they were travelling, and the alert was cleared as a false positive. For a potential account compromise, the investigation record would be more extensive: the alert was reviewed, the session was terminated, the user was contacted, the password was reset, and a forensic review of the session was conducted. The documentation standard is that any auditor reading the record can understand what happened, what was investigated, and what action was taken.
How does A.8.16 interact with A.5.25 and A.5.26 covering information security incident management?
A.8.16’s anomaly detection feeds into the incident management process covered by A.5.25 (assessment and decision on information security events) and A.5.26 (response to information security incidents). When A.8.16’s monitoring detects an anomaly that is assessed as a genuine security incident rather than a false positive, the incident management process under A.5.25 and A.5.26 is triggered. The monitoring and incident management controls are therefore sequential: A.8.16 detects the signal, A.5.25 assesses whether it constitutes an incident, and A.5.26 governs the response. Organisations implementing A.8.16 should ensure their incident management process is connected to the anomaly detection alert workflow so that escalation from detection to incident response is structured and documented.
Can an organisation satisfy A.8.16 using only the authentication layer monitoring from an IAM platform without network or endpoint monitoring?
A.8.16 requires monitoring of networks, systems, and applications. The authentication layer is one component of this scope but not the complete scope. An organisation that monitors only authentication events satisfies A.8.16 for the authentication layer but has gaps in network anomaly detection and endpoint behaviour monitoring. For organisations seeking ISO 27001 certification, the scope of A.8.16 monitoring must be assessed against the organisation’s ISMS scope. For an ITeS company whose ISMS scope covers its service delivery infrastructure, authentication and application monitoring may be sufficient. For a bank with a broader ISMS scope covering network infrastructure, network monitoring is also required. The authentication-layer monitoring that Akku provides is a necessary component of A.8.16 compliance but may need to be supplemented with network and endpoint monitoring depending on the organisation’s ISMS scope.
Introduction IRDAI ICS Annexure III Item 10 requires that user accounts inactive beyond a defined…
Introduction ISO 27001:2022 Annex A.5.18 requires that access rights be reviewed at regular intervals and…
Introduction SOC 2 Trust Services Criteria CC5.1 requires that the entity selects and develops control…
Introduction SEBI CSCRF applies to all regulated entities but differentiates requirements by entity tier. Market…
Introduction SEBI CSCRF PR.AA.S1(G1g) and PR.AA.S1(G1h) require that user accounts inactive beyond a defined threshold…
Introduction ISO 27001:2022 Annex A.8.2 requires that the allocation and use of privileged access rights…