Essential Eight RA-ML2.9 Event logs are analysed promptly for security events

This control partially meets A.8.15.

E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.15 requires logs to be produced, stored, protected and analysed across activities, exceptions and faults, covering the full logging lifecycle beyond just analysis and beyond just internet-facing servers. E8-RA-ML2.9 is therefore a specific, higher-priority slice of the broader logging control in Annex A 8.15.

This control partially meets A.8.16.

E8-RA-ML2.9 focuses on promptly analysing internet-facing server event logs to detect cyber security events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents, which can include but is not limited to log analysis. E8-RA-ML2.9 is a specific implementation approach within the broader monitoring expectation of Annex A 8.16.

This control is equivalent to ISM-1906.

E8-RA-ML2.9 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 states the same requirement for timely analysis of internet-facing server logs to detect cyber security events. The scope and intent align closely, with no meaningful difference in depth or coverage.

This control partially meets ISM-1228.

E8-RA-ML2.9 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1228 is broader, requiring cyber security events (from any source) to be analysed in a timely manner to identify incidents, not limited to logs or internet-facing servers. E8-RA-ML2.9 is a specific log-focused detection requirement that feeds into the broader analysis obligation in ISM-1228.

This control partially meets ISM-1526.

ISM-1526 requires system owners to continuously monitor system security and manage cyber threats, security risks and controls within defined system boundaries and objectives. E8-RA-ML2.9 supports this by mandating timely analysis of event logs from internet-facing servers to detect security events, providing key monitoring evidence used in ongoing risk management. E8-RA-ML2.9 is narrower and technical, while ISM-1526 is governance-focused and applies across the whole system and its risk/control posture.

This control partially overlaps ISM-1607.

ISM-1607 requires integrity monitoring and centralised event logging for shared server hardware using software isolation. E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cybersecurity events. While ISM-1607 is specific to virtualisation layers and logging, E8-RA-ML2.9 focuses on the operational review and analysis of these logs.

This control partially overlaps ISM-1907.

E8-RA-ML2.9 requires event logs from internet-facing servers to be analysed promptly to detect cyber security events. ISM-1907 applies the same timely log analysis requirement but for non-internet-facing servers, aligning on the analysis activity and purpose. They differ mainly by asset exposure scope (internet-facing vs internal).

This control partially overlaps ISM-1960.

E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1960 applies the same timely log analysis requirement to internet-facing network devices rather than servers. They overlap in the detection objective and timeliness expectation, but differ in asset class (servers versus network devices).

This control partially overlaps ISM-1961.

E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1961 requires timely analysis of event logs from non-internet-facing network devices for the same detection purpose. They overlap in the expectation of prompt review for security event detection, but they apply to different asset classes.

This control partially overlaps ISM-1986.

E8-RA-ML2.9 requires prompt analysis of internet-facing server logs to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers. The controls align on the action (timely analysis) and objective (detect events) but differ on the scoping dimension (internet exposure vs criticality).

This control partially overlaps ISM-1987.

E8-RA-ML2.9 requires prompt analysis of internet-facing server logs to detect cyber security events. ISM-1987 requires timely analysis of logs from security products, which may include server telemetry. The overlap is the expectation of timely review to detect events.

This control supports ISM-0580.

ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. E8-RA-ML2.9 focuses on prompt analysis of event logs for security events, which is a monitoring and response expectation that should be defined (roles, frequency, SLAs) within the policy required by ISM-0580. ISM-0580 is broader governance, while E8-RA-ML2.9 is a specific operational analysis requirement.

This control depends on ISM-0120.

ISM-0120 requires providing cyber security personnel with tools and data sources to monitor for indicators of compromise. E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cyber security events, which requires log availability and suitable analysis tooling for cyber security staff. E8-RA-ML2.9 mandates an analysis activity for a specific server class, while ISM-0120 addresses the prerequisite capability to perform that monitoring effectively.

This control depends on ISM-1978.

ISM-1978 requires security-relevant events for server applications on internet-facing servers to be centrally logged. E8-RA-ML2.9 builds on that log availability by requiring timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1978 focuses on centralised collection, while the candidate focuses on operational detection through analysis.

This control partially overlaps IT.DET-03.1.

IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML2.9 requires timely analysis of internet-facing server event logs to detect cyber security events, which that triage then assesses against the thresholds.