Essential Eight MF-ML2.9 Cyber security events are analysed to identify incidents timely

This control partially overlaps A.5.7.

Annex A 5.7 requires organisations to collect and analyse information about information security threats to produce actionable threat intelligence. E8-MF-ML2.9 relates by requiring timely analysis of cyber security events to identify incidents, which is one important internal source of threat intelligence. However, E8-MF-ML2.9 is focused on operational event triage/incident identification rather than broader external and strategic threat intelligence collection and analysis covered by Annex A 5.7.

This control partially overlaps A.5.25.

E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 5.25 similarly requires organisations to assess security events and decide whether they should be categorised as incidents, which aligns to the event-to-incident determination in E8-MF-ML2.9. However, Annex A 5.25 is focused on the assessment/decision process (including categorisation) without explicitly requiring timeliness, while E8-MF-ML2.9 emphasises timely analysis to enable rapid identification.

This control partially overlaps A.8.16.

E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify incidents. Annex A 8.16 requires monitoring networks/systems/applications for anomalous behaviour and taking actions to evaluate potential incidents, which overlaps with analysing events to decide if they indicate an incident. Annex A 8.16 is broader in including continuous monitoring and anomaly detection, while E8-MF-ML2.9 focuses on timely analysis of events to identify incidents.

This control supports A.8.15.

E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify incidents. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant events, which supports E8-MF-ML2.9 by ensuring the necessary log data exists and is suitable for analysis. Annex A 8.15 is broader across the full logging lifecycle, while E8-MF-ML2.9 is specifically about timely event analysis for incident identification.

This control partially overlaps A.6.2.6.

Annex A 6.2.6 requires documented processes for ongoing operation of an AI system, including system/performance monitoring and support. E8-MF-ML2.9 overlaps by requiring cyber security events to be analysed in a timely manner, which is a monitoring-and-response activity within AI system operations for detecting compromise or abnormal behaviour. E8-MF-ML2.9 is security-incident focused, whereas Annex A 6.2.6 also includes non-security operational monitoring, repairs and update/support management.

This control is equivalent to ISM-1228.

E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1228 states the same requirement using effectively identical language and intent, focusing on prompt analysis to determine whether events constitute incidents. Both controls are about the decision/triage step from event to incident rather than only log generation or collection.

This control partially meets ISM-1907.

E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents. ISM-1907 focuses specifically on timely analysis of event logs from non-internet-facing servers to detect cyber security events, which contributes to the broader event analysis required by E8-MF-ML2.9. The candidate is a subset (one log source category), whereas E8-MF-ML2.9 applies to cybersecurity events across the environment and drives incident identification.

This control partially meets ISM-1960.

E8-MF-ML2.9 requires timely analysis of cybersecurity events to identify incidents. ISM-1960 is a narrower requirement focused on analysing logs from internet-facing network devices to detect cyber security events, which contributes to the broader analysis required by E8-MF-ML2.9. The primary control applies across event sources and includes determining when detected events are incidents.

This control partially meets ISM-1961.

E8-MF-ML2.9 requires cyber security events to be analysed promptly to identify incidents. ISM-1961 is narrower, requiring timely analysis of event logs from non-internet-facing network devices to detect events, providing one channel of telemetry used to meet E8-MF-ML2.9. E8-MF-ML2.9 covers a wider set of event sources and emphasises incident identification rather than only log review for detection.

This control partially meets ISM-1986.

E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents. ISM-1986 narrows this to timely analysis of event logs from critical servers to detect cyber security events, which is one source feeding the broader event-analysis function in E8-MF-ML2.9. E8-MF-ML2.9 is not limited to critical server logs and includes wider event sources and the specific goal of incident identification.

This control partially meets ISM-1987.

E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents. ISM-1987 specifically requires timely analysis of logs from security products (e.g. EDR/SIEM/IDS) to detect cyber security events, which directly supports the event analysis activity in E8-MF-ML2.9. The candidate is limited to a particular class of logging source, while E8-MF-ML2.9 is broader and includes deciding when events constitute incidents.

This control depends on ISM-1213.

ISM-1213 requires enhanced post-remediation monitoring until there is evidence-based confidence the adversary has been eradicated and has not re-established access. E8-MF-ML2.9 supports this by requiring timely analysis of cybersecurity events so that any re-compromise indicators during the enhanced-monitoring period are detected and escalated quickly. E8-MF-ML2.9 is not specifically post-incident or tied to eradication confidence, whereas ISM-1213 is explicitly a post-remediation assurance activity.

This control depends on ISM-1526.

ISM-1526 requires system owners to continuously monitor each system's security and manage associated threats, risks and controls within defined system boundaries and objectives. E8-MF-ML2.9 supports this by requiring timely analysis of cybersecurity events so the monitoring activity results in incident identification and action. ISM-1526 is broader and governance-focused (ownership, boundaries, objectives and risk management), while E8-MF-ML2.9 is a specific operational monitoring/analysis outcome.

This control depends on ISM-1536.

ISM-1536 requires central logging of all software database queries and the resulting crash or error messages. This supports E8-MF-ML2.9 because centrally captured database query/error logs provide key inputs for timely investigation and correlation when analysing cyber security events to identify incidents. E8-MF-ML2.9 is about analysis and incident identification, while ISM-1536 is about ensuring the relevant database-related evidence exists in a central location.

This control depends on ISM-1906.

E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents. ISM-1906 mandates timely analysis of event logs from internet-facing servers to detect cyber security events, which provides a key source of events that must then be analysed under E8-MF-ML2.9 to confirm incidents.

This control partially overlaps IT.DET-03.1.

IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify incidents, so both centre on promptly deciding which events are incidents.

This control partially overlaps IT.DET-03.2.

IT.DET-03.2 requires incidents to be identified from indicators across identities, applications, data and infrastructure, not isolated signals; E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents, sharing that goal but not saying which indicators the analysis should draw on.

This control partially overlaps IT.DET-04.1.

IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-MF-ML2.9 (multi-factor authentication) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.