A.8.16 Audit Checklist

When to use this

Use this checklist during an internal audit of security monitoring, alerting, anomaly detection, triage, escalation, and incident evaluation.

Related controls

• A.8.16 Monitoring Activities
• A.8.16 Audit Evidence Pack
• Monitoring Detection Use Case Register
• Monitoring Coverage and Data Source Map
• Monitoring Alert Threshold Review
• Out-of-Hours Monitoring Escalation Checklist

Audit checklist

• Review monitoring strategy, standard, or procedure.
• Trace monitoring requirements from risk assessment and critical assets.
• Review detection use cases and alert rules.
• Sample monitoring coverage across networks, systems, applications, cloud, and security tools.
• Review blind spots and compensating controls.
• Review alert thresholds and tuning evidence.
• Sample alert triage records.
• Trace true positives to event assessment or incident response records.
• Check evidence of false-positive and event-fatigue management.
• Check out-of-hours escalation procedure and test evidence.
• Review monitoring performance and improvement records.

Findings table