What to monitor
Watching a system, process or activity establishes its current state for a stated information need.
What the published 2016 guidance says
Watching a system, process or activity establishes its current state for a stated information need. The guidance lists a wide field: how the management system processes are carried out; incident, vulnerability and configuration management; awareness and training; access control; event logging; audit; risk assessment and treatment; third parties; continuity; physical and environmental security; and system monitoring. The output is data, such as logs, interviews, training counts or incident records, which other measures can use. Where a control exists to watch something, record whether the data came before or after a treatment action, or the result cannot be interpreted.
What it means in practice
Monitoring supplies the raw data. It covers the ISMS processes as well as the technical estate: incidents, vulnerabilities, configuration, awareness, access, logging, audit, risk treatment, third parties, continuity and physical security. Record whether the data were collected before or after a treatment action, or the measure cannot tell you what caused the change.
Status of this record. For 6.2, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
List the monitored entities and the data each produces. Mark the ISMS processes as well as the technical systems. For each data set, record whether it is collected before or after treatment, and who owns it.
Evidence an assessor asks for
- MonitoringAn inventory of monitored systems, processes and activities with the data each produces
- Performance evaluationMonitoring data records annotated with whether treatment action had already been taken
The question an assessor will ask
An assessor will ask for an inventory of monitored systems, processes and activities with the data each produces. The test for 6.2 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Monitoring outputs used as measures with no record of the treatment state at the time
- Monitoring limited to technical logs, with the ISMS processes themselves unmonitored
Before the next review
Before the next review, test this against one live record: monitoring outputs used as measures with no record of the treatment state at the time.
What to check when the revision publishes
When DIS 27004 is published, compare the 6.2 What to monitor record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.