Which ISO 27001 controls does network monitoring help with?

Mainly the controls on logging and monitoring activities, and the network security and incident management controls around them. In the 2022 edition of the annex, logging (8.15) asks you to produce, protect and analyse records of activity, and monitoring activities (8.16) asks you to monitor networks, systems and applications for anomalous behaviour and act on it. Network detection evidences both directly. It also supports networks security (8.20), by showing which devices talk across segments, and the incident management controls, by giving a dated starting point for assessing and responding to events and collecting evidence. Asset inventory benefits too, since a network map shows devices that are not in your list. Monitoring does not cover access rights, backups, secure development or supplier contracts, so do not stretch the mapping. In your statement of applicability, name the tool, the segments it covers, who reviews alerts and where records are kept. NetSenX’s network map, alert history and audit log, on every plan, and its PDF compliance reports, from the Starter plan, can serve as that evidence.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics