Essential Eight AC-ML2.8 Cyber security events are analysed in a timely manner
What it says
Cybersecurity events are analysed in a timely manner to identify cybersecurity incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTimely analysis of events to spot and manage security incidents.
This control is about ensuring that when security alerts pop up on your systems, somebody is looking at them quickly. It's like a fire alarm sounding in your house: if nobody checks why it's ringing, a small fire could turn into something much worse. Without reviewing these alerts promptly, hackers might sneak in and cause serious damage before anyone even notices.
Free. Save your status, tasks and notes.
Why it matters
Delayed event analysis can let threats persist undetected, leading to severe breaches with longer incident recovery times.
How to implement
IT staff should ensure all security event logs from critical systems are centralised so they can be monitored easily.
This can be done by setting up a logging system that collects data from all your key computers and servers.
The security officer should assign team members to monitor these logs at regular intervals.
This might mean setting up a schedule where staff commit a couple of hours each day to review the logs.
System administrators should configure alerts for unusual activities within these logs.
This involves setting up notifications that get sent to the team if unusual patterns or attempts to breach security are detected.
Managers should make sure there's a clear process for analysing and responding to alerts.
This could be a simple checklist or guide that explains what to do when an alert comes up, who to contact, and how to take action.
Keep it running
Triage security alerts within 24 hours, correlate logs/EDR/SIEM sources, and record analysis outcomes to confirm whether events meet incident criteria.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How regularly are the event logs analysed to detect security incidents?
Look at
Examine documented procedures or schedules showing log analysis times.
Good evidence
There is a documented policy that specifies daily analysis of security logs with a record of who performed the analysis.
- Check 2 of 2What an auditor asks for
Ask for
What happens when a cyber security event is identified?
Look at
Check incident response procedures and logs of past incidents.
Good evidence
The organisation has a clear, documented process with timely reporting to relevant stakeholders, such as the chief information security officer.
Mappings
Closest match in ASD Information Security Manual: ISM-1228, Analyse cyber security events promptly, which asks for the same thing.
ISO/IEC 27001: 5 mappings
This control partially overlaps A.5.7.
Annex A 5.7 requires organisations to collect and analyse information security threat information to produce threat intelligence. E8-AC-ML2.8 overlaps by requiring timely analysis of cyber security events to identify incidents, which contributes operational indicators and patterns that can be incorporated into threat intelligence. E8-AC-ML2.8 is narrower and operational (event analysis for incident identification), while Annex A 5.7 also covers external threat sources and broader intelligence products for prevention and preparedness.
This control partially overlaps A.5.25.
E8-AC-ML2.8 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 5.25 requires the organisation to assess information security events and decide whether they should be categorised as incidents, which aligns with the decision/triage outcome of E8-AC-ML2.8. Annex A 5.25 is broader in governance/decisioning (classification and determination) while E8-AC-ML2.8 emphasises timeliness of analysis as an operational detection activity.
This control partially overlaps A.5.28.
E8-AC-ML2.8 requires timely analysis of cyber security events to identify cyber security incidents. Annex A 5.28 relates by requiring procedures to identify, collect and preserve evidence associated with information security events, which often occurs during/after analysis and triage. E8-AC-ML2.8 is about speed and effectiveness of analysis for incident identification, while Annex A 5.28 is about evidentiary handling and forensic soundness.
This control partially overlaps A.8.16.
E8-AC-ML2.8 requires cyber security events to be analysed in a timely manner to identify incidents. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents, which includes analysis/triage activities. Annex A 8.16 is broader because it explicitly covers establishing monitoring for anomalies, whereas E8-AC-ML2.8 focuses on the timely analysis step to determine incident status.
This control supports A.5.26.
E8-AC-ML2.8 requires timely analysis of cyber security events so incidents are identified early. Annex A 5.26 requires responding to information security incidents according to documented procedures, which depends on incidents being identified and confirmed. Timely analysis under E8-AC-ML2.8 supports faster and more effective execution of the response activities required by Annex A 5.26, but it does not itself define response actions.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1228.
E8-AC-ML2.8 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1228 states the same requirement, with the same intent of prompt event analysis for incident identification. Both controls focus on the analysis/triage step rather than prescribing specific logging sources or tooling.
This control is broader than ISM-1961.
ISM-1961 mandates timely analysis of event logs from non-internet-facing network devices to detect cyber security events. E8-AC-ML2.8 is broader because it requires timely analysis of cyber security events to identify incidents, without specifying log sources, device types, or network exposure. ISM-1961 is a more specific control that contributes to meeting the candidate by ensuring network-device-derived events are identified quickly.
This control partially meets ISM-1906.
E8-AC-ML2.8 requires prompt analysis of cyber security events so incidents are identified quickly. ISM-1906 requires timely analysis of event logs from internet-facing servers to detect cyber security events. This is one important subset of the overall event-analysis obligation described by E8-AC-ML2.8.
This control partially meets ISM-1907.
E8-AC-ML2.8 requires organisations to analyse cyber security events in a timely manner to determine whether they are incidents. ISM-1907 focuses that requirement on event logs from non-internet-facing servers, requiring those logs to be analysed promptly to detect events. This is a scoped implementation area that sits within the wider, whole-of-environment intent of E8-AC-ML2.8.
This control partially meets ISM-1986.
E8-AC-ML2.8 requires timely analysis of cyber security events to identify cyber security incidents across the environment. ISM-1986 narrows this to timely analysis of event logs from critical servers specifically to detect cyber security events. ISM-1986 is therefore one concrete subset of the broader event-analysis expectation in E8-AC-ML2.8.
This control partially meets ISM-1987.
E8-AC-ML2.8 requires timely analysis of cyber security events so that incidents can be identified. ISM-1987 specifically requires timely analysis of event logs produced by security products (e.g. EDR/SIEM/security appliances) to detect events. The candidate is a subset channel of telemetry, while E8-AC-ML2.8 is broader about event analysis regardless of source.
This control depends on ISM-0120.
ISM-0120 requires equipping cyber security personnel with tools and data sources to monitor for key indicators of compromise. E8-AC-ML2.8 requires timely analysis of cyber security events to identify incidents, which is facilitated by access to consolidated telemetry and analysis platforms. E8-AC-ML2.8 is outcome-oriented (analysis to identify incidents), while ISM-0120 is capability-oriented (ensuring the inputs and tools exist for that analysis).
- ISM-1526System owners continuously monitor security and manage threats, risks and controlsDepends on
This control depends on ISM-1526.
ISM-1526 requires system owners to continuously monitor system security and manage cyber threats and risks for each system. E8-AC-ML2.8 supports this requirement by ensuring cybersecurity events are analysed in a timely manner to identify incidents, which is a core input to continuous monitoring and risk treatment decisions. E8-AC-ML2.8 focuses on operational incident detection/triage, whereas ISM-1526 also covers boundary/objective setting and overall control governance.
This control depends on ISM-1960.
E8-AC-ML2.8 requires organisations to analyse cyber security events in a timely manner to identify incidents. ISM-1960 operationalises this for a specific log source by requiring timely analysis of event logs from internet-facing network devices to detect cyber security events. ISM-1960 is narrower (specific device class and log type), while E8-AC-ML2.8 applies across cyber security event sources and focuses on identifying incidents from events.
This control depends on ISM-2116.
ISM-2116 requires use of cyber threat intelligence services to support the detection of cyber security events and identification of incidents. ASD Essential Eight E8-AC-ML2.8 requires timely analysis of cyber security events to identify incidents, and ISM-2116 supports this by providing incident correlation inputs (e.g. validated IOCs, actor TTPs, campaign timelines, and confidence ratings) that help analysts rapidly confirm maliciousness and scope during triage. E8-AC-ML2.8 is about the analysis activity and timeliness, while ISM-2116 is about ensuring the analysis is intelligence-driven rather than purely telemetry-driven.
ASD Essentials for enterprise IT: 3 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML2.8 requires cyber security events to be analysed in a timely manner to identify cyber security incidents, closely matching that triage.
- IT.DET-03.2Correlate signals across identities, applications, data and infrastructure to identify incidentsPartially overlaps
This control partially overlaps IT.DET-03.2.
IT.DET-03.2 requires incidents to be identified from indicators across identities, applications, data and infrastructure, not isolated signals; E8-AC-ML2.8 requires timely analysis of cyber security events to identify incidents, and IT.DET-03.2 shapes how that analysis is done.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AC-ML2.8 (application control) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.