ISO 27001 file integrity monitoring
Operating evidence for every month between audits.
Annex A asks you to monitor systems for anomalies, manage configurations, control changes and keep working backups. Alertica checks the files behind all four from outside your servers, and records who reviewed each alert and why. That is the operating evidence your certification body asks for at every visit.
- Agentless, nothing to install
- Evidence for Annex A 8.9 and 8.16
Who it's for
Companies with an ISMS that need operating evidence for the technological controls in their Statement of Applicability.
Built for
- Companies certifying to ISO/IEC 27001:2022 for the first time, or moving from the 2013 version
- ISMS owners and the consultants who run it for them, ahead of a surveillance audit
- Servers and backup targets reachable over SFTP
What Alertica covers in ISO 27001
Five Annex A controls Alertica gives you evidence for, with what stays with you in the last column.
| Control | What it asks | What Alertica does | What you still do |
|---|---|---|---|
| 8.9 Configuration management | Establish, document, implement, monitor and review configurations, security settings included. | Alerts when a config file changes, contents included, so drift from the approved configuration shows up the next scan. | Define and approve the configurations. |
| 8.16 Monitoring activities | Monitor networks, systems and applications for anomalous behavior, and act on what you find. | Watches critical files and folders and alerts on changes, mass deletion and suspicious file names. Each alert is acknowledged with a note. | Monitor networks and user activity, which 8.16 also covers. |
| 8.32 Change management | Changes to systems follow a change management procedure. | Every change to watched files is seen, so a change made outside the procedure surfaces. The note links each change to its record. | Run the procedure, and approve each change. |
| 8.13 Information backup | Keep backup copies of information and systems, and test them regularly. | Alerts when a backup doesn't arrive, shrinks sharply since the last scan, or a stored copy changes. | Test restores. |
| 8.15 Logging | Produce, store, protect and analyze logs of activities and events. | Alerts when archived logs change or disappear. | Produce the logs and analyze them. |
What your auditor sees
Certification runs on a three-year cycle, with a surveillance audit at least once a year. The auditor samples the months since the last visit. Alertica keeps the answer for every date.
-
Every alert, with who reviewed it
Each alert is acknowledged with a name, a time and a required note. That note shows you acted on what 8.16 found, and ties each change to its record for 8.32.
-
Twelve months of history
Pro keeps a year of alerts and scans, which covers the gap between one surveillance audit and the next.
-
Proof it ran every week
Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. It shows the monitoring 8.16 asks for ran all year, not only before the audit.
-
Audit-ready evidence in one download
Pick the months since the last audit and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter.
Why from outside the server
-
Nothing to install
No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.
-
Nothing to switch off
An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.
-
Only fingerprints leave
Alertica works out a fingerprint of each file on your server. File contents never leave it.
-
Set up with you
On Pro and Enterprise our team sets the rules to match 8.9 and 8.16 with you, server by server.
Live in three steps
-
Connect a server
Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.
-
Set your rules
Pick a folder and say what matters. We set up the rules to match Annex A with you on Pro.
-
Choose who hears about it
Add the people who should get alerts, by email, SMS or Slack. Each one is kept for your auditor.
Questions about ISO 27001
What Alertica covers in Annex A.
-
Does ISO 27001 require file integrity monitoring?
Annex A 8.16 asks you to monitor systems for anomalous behavior, and 8.9 to monitor configurations. File monitoring gives you evidence for both on your servers.
-
Will Alertica get us certified?
Certification covers your whole ISMS. Alertica gives you operating evidence for the controls in the table above, ready at every audit.
-
What does Alertica record for each change?
What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.
-
Do you copy our files?
No. Alertica works out a fingerprint of each file on your server and reads back only that, with the file's name, size and date. File contents never leave the server.
Set up Annex A 8.9 and 8.16 with our team
Tell us which controls are in your Statement of Applicability. We'll set up the rules to match them with you and go through the first scan together.