Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Definition and monitoring of alarm policies

Critical
High
Normal
Low

Often, security tools provide a way to set alert policies when something potentially dangerous happens in an organization's environment. For example, Microsoft 365 has built-in alert policies to alert you to abuse of administrator privileges, malware, potential internal and external risks, and data security risks.

The organization must identify security-related events in data systems and the environments in which they operate. To respond to changes related to these events, alarm policies must be created.

Alarm policies need to be actively monitored and modified based on experience.

Connected other frameworks and requirements:
12.4.1: Event logging
ISO 27001
16.1.7: Collection of evidence
PR.DS-4: Availability
NIST CSF
DE.AE-5: Incident alert thresholds
NIST CSF
RS.AN-1: Notifications from detection systems
NIST CSF

Anticipating capacity-related problems

Critical
High
Normal
Low

The operation of information systems may depend on certain key resources, such as server capacity, file storage capacity, data processing capacity, monitoring capacity or certain key persons.

In particular, some of these resources may have long delivery times or high costs in certain situations, in which case special attention must be paid to future capacity problems with them.

We monitor the use of key system resources and identify trends, potential security bottlenecks and dependencies on important people.

Connected other frameworks and requirements:
11.2.2: Supporting utilities
ISO 27001
12.1.3: Capacity management
ISO 27001
PR.DS-4: Availability
NIST CSF
8.6: Capacity management
ISO 27001
7.11: Supporting utilities
ISO 27001
No items found.