ISM-0120 policy ASD Information Security Manual (ISM)

Ensure Cyber Security Personnel Have Necessary Tools

Cyber security staff must have the tools and data to spot system threats quickly.

Detective NC OS P ASD Information Security ManualGuidelines for cyber security incidents asset management incident detection awareness training

record_voice_over

Plain language

Ensuring your cyber security team has the right tools and data is like giving a firefighter both a hose and water. They need them to spot problems, like hackers breaking in, before major damage is done. Without the necessary tools, cyber threats could go unnoticed, leading to serious breaches of security and potential data loss.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Detective

Classifications

NC, OS, P, S, TS

ISM last updated

Apr 2020

Control Stack last updated

19 Mar 2026

E8 maturity levels

N/A

Guideline

Guidelines for cyber security incidents

Section

Managing cyber security incidents

Topic

Access to Sufficient Data Sources and Tools

Official control statement

Cyber security personnel have access to sufficient data sources and tools to ensure that systems can be monitored for key indicators of compromise.

policy ASD Information Security Manual (ISM) ISM-0120

priority_high

Why it matters

If security staff lack access to key telemetry and detection tools (e.g., logs, SIEM/EDR), indicators of compromise may be missed, delaying response and increasing breach impact.

settings

Operational notes

Periodically confirm cyber staff can access required data sources and tools (e.g., central logs, SIEM, EDR, DNS/proxy) and review coverage to detect key indicators of compromise.

02 - Implement

build

Implementation tips

The IT team should conduct an inventory of existing cyber security tools to identify any gaps. Review what tools you currently have, such as firewall systems and threat detection, and see if there's anything missing that would help spot threats better.
Managers should liaise with cybersecurity experts to ensure all tools are updated and functioning as intended. Schedule regular check-ins to verify that systems like anti-virus software and monitoring applications are current and running smoothly.
Procurement should work with the IT team to acquire any necessary new tools or software. Research industry standards and feedback from current software users to make informed purchasing decisions.
The security officer should ensure staff are trained to use the existing tools efficiently. Organise workshops or training sessions where staff can practice using the tools to spot typical signs of compromise.
Business owners should regularly review the company's data sources' security level with their IT team. Establish which informational resources are critical and ensure they are well protected with current security measures.

03 - Audit

fact_check

Audit / evidence tips

AskA list of current tools and software used for threat detection GoodIncludes a comprehensive list with recent updates displayed
AskThem about processes for monitoring threats and how effective they feel the current tools are GoodShows clear understanding and satisfaction with the tools provided
GoodDemonstration will clearly show a streamlined process for detecting issues
GoodRecord will display regularly updated agreements and recent purchases reflecting technology improvements

04 - Mappings

link

Cross-framework mappings

How ISM-0120 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
handshake Supports (2) expand_less
Annex A 8.6	Annex A 8.6 requires monitoring of resource use and subsequent adjustment to prevent performance degradation or outages
Annex A 8.16	ISM-0120 requires cyber security personnel to have sufficient data sources and tools to monitor systems for key indicators of compromise

E8

Control	Notes	Details
handshake Supports (5) expand_less

E8-AC-ML2.7	ISM-0120 requires cyber security personnel to have the tools and data sources needed to monitor for indicators of compromise
E8-AC-ML2.8	ISM-0120 requires equipping cyber security personnel with tools and data sources to monitor for key indicators of compromise

E8-AH-ML2.11	ISM-0120 requires cyber security personnel to have access to sufficient data sources and tools to monitor systems for indicators of compr...

E8-RA-ML2.9	ISM-0120 requires providing cyber security personnel with tools and data sources to monitor for indicators of compromise
E8-RA-ML3.8	ISM-0120 requires cyber security personnel to have access to sufficient data sources and tools to monitor systems for key indicators of c...
extension Depends on (7) expand_less

E8-AC-ML2.6	ISM-0120 requires cyber security personnel to have access to sufficient data sources and tools so systems can be monitored for indicators...

E8-AH-ML2.13	ISM-0120 requires cyber security personnel to have access to sufficient data sources and tools for monitoring indicators of compromise
E8-AH-ML2.15	E8-AH-ML2.15 requires organisations to analyse cyber security events in a timely manner to identify incidents
E8-AH-ML3.4	E8-AH-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events
E8-AH-ML3.5	E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events

E8-MF-ML3.4	E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events
E8-MF-ML3.5	E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.