Trygg note
The Pillars of Observability
See what the systems already show, then keep that picture in the program.
Trygg. October 26, 2026. This is a Trygg note. The sources are listed at the end.
Join to save this for later.
Join to tell us if this was useful.
Logs, metrics, and traces
Observability means you can tell what a system is doing from what it already puts out.
The timestamped record of what happened. They are the trail an investigation and an audit both ask for. That record is A.8.15 Logging. Watching it for something unusual is A.8.16 Monitoring activities.
The numbers that show health: how full a system is, how often something fails, how long the work takes. Having enough room for the work is A.8.6 Capacity management.
One request followed across the services it touches, which helps explain a slow or broken path. Trygg does not add that tracing. The customer's own systems keep it, when they have it.
What an ISO 27001 program still needs
The three pillars are an engineering idea. A security program still needs a person to look at what came out.
- An event is something security-relevant, such as a sign-in or a privilege change. A.5.25 Assessment and decision on information security events is the decision about what that event means. A.5.26 Response to information security incidents is the response when it is an incident.
- Supplier relationships need a clear view of who holds the work. That is A.5.21 Managing information security in the ICT supply chain.
- A change needs a review before it spreads. That is A.8.32 Change management.
- Settings need to stay where the program put them. That is A.8.9 Configuration management.
- Alerts in the customer's own tools are how a person hears about it. The portal does not sit up overnight and answer those alerts.
How Trygg brings it into the program
Logs, metrics, and alerts stay in the systems the customer already runs. Security Insights reads the monthly records those systems produce for identity, mail, endpoints, and backups, and turns them into a score. Objectives show whether that score met the target the program set. Risks, reviews, training, and audit readiness sit beside that picture. A leader and an auditor are looking at a live record of whether the watching is happening. Trygg does not replace the logging platform.
The picture has to live in the program
A dashboard in one tool is not the program. The same outputs have to meet an owner, an objective, and a record an auditor can walk.
What the systems already show today is the evidence the program can stand on tomorrow.
ISO/IEC 27001:2022
An auditor will ask whether activity is logged, whether someone reviews events and responds to incidents, whether capacity and configuration stay in view, and whether supplier relationships and changes are managed.
- A.8.15 Logging
- A.8.16 Monitoring activities
- A.8.6 Capacity management
- A.5.25 Assessment and decision on information security events
- A.5.26 Response to information security incidents
- A.5.21 Managing information security in the ICT supply chain
- A.8.32 Change management
- A.8.9 Configuration management