ASD ISM 0120 Access to tools for detecting security events
What it says
Cyber security personnel have access to sufficient tools to facilitate the detection of cyber security events and the identification of cyber security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure cyber security staff have tools to detect and identify security threats and incidents.
This control ensures that your cyber security team has the right tools to spot potential security threats before they become real problems. If they lack these tools, issues might go unnoticed, causing harm like data breaches or reputational damage.
Free. Save your status, tasks and notes.
Why it matters
Without proper tools, cyber security threats can go unnoticed, leading to data breaches, financial loss, and damage to the organisation's reputation.
How to implement
Management should ensure that the IT team is equipped with security monitoring tools.
This can be done by budgeting for and acquiring necessary software that allows monitoring of the network and systems effectively.
The IT team should install and configure these tools.
They should set them up to detect unusual activity by tailoring tools to the specific environment and business needs of the organisation.
Cyber security staff should be trained to use the tools effectively.
This includes setting up workshops or online courses to ensure they know how to interpret alerts and respond to them appropriately.
Managers should conduct regular reviews with IT to evaluate the effectiveness of these tools.
This can involve checking reports generated by the tools and discussing how the information is being used to enhance security.
Procurement should liaise with IT to maintain licenses for security tools.
This includes keeping track of renewals to ensure continuous access to critical software without interruption.
Keep it running
Regularly review tool configurations and updates to ensure they remain effective against evolving threats. Continuous staff training on these tools is essential.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
logs or reports generated by the security monitoring tools.
Look at
the frequency and types of alerts recorded.
Good evidence
is detailed logs highlighting potential threats and corresponding actions taken.
- Check 2 of 5What an auditor asks for
Good evidence
all staff have up-to-date training certificates.
- Check 3 of 5What an auditor asks for
Ask for
a list of security tools currently in use. Look to see if their functions align with identifying and detecting threats.
Good evidence
is a comprehensive list matching the organisation's threat profile.
- Check 4 of 5What an auditor asks for
Look at
details on who is responsible for what.
Good evidence
has clear roles, responsibilities, and a schedule for tool maintenance and updates.
- Check 5 of 5What an auditor asks for
Ask for
to see budget records for security tool procurement.
Look at
entries detailing software purchases and renewals.
Good evidence
includes documented purchases matching the tools listed in use.
Mappings
Closest match in ASD Essentials for enterprise IT: IT.DET-03.1, Triage alerts and events promptly against defined incident thresholds, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control supports A.8.16.
ISM-0120 requires cyber security personnel to have sufficient data sources and tools to monitor systems for key indicators of compromise. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which depends on having effective monitoring tools and accessible telemetry. Annex A 8.16 sets an operational monitoring requirement, while ISM-0120 focuses on enabling capability (tooling and data access) rather than mandating monitoring activities themselves.
ASD Essential Eight: 9 mappings
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsSupports
This control supports E8-AC-ML2.7.
ISM-0120 requires cyber security personnel to have the tools and data sources needed to monitor for indicators of compromise. E8-AC-ML2.7 requires timely analysis of event logs from internet-facing servers to detect cyber security events, which depends on log access and analysis tooling being provided to cyber security staff. E8-AC-ML2.7 is specific to a log source and analysis activity, while ISM-0120 is broader enablement across monitoring capability and data sources.
This control supports E8-AC-ML2.8.
ISM-0120 requires equipping cyber security personnel with tools and data sources to monitor for key indicators of compromise. E8-AC-ML2.8 requires timely analysis of cyber security events to identify incidents, which is facilitated by access to consolidated telemetry and analysis platforms. E8-AC-ML2.8 is outcome-oriented (analysis to identify incidents), while ISM-0120 is capability-oriented (ensuring the inputs and tools exist for that analysis).
This control supports E8-AH-ML2.15.
E8-AH-ML2.15 requires organisations to analyse cyber security events in a timely manner to identify incidents. ISM-0120 ensures cyber security personnel have sufficient data sources and tools to monitor for indicators of compromise, necessary for effective event analysis.
This control supports E8-AH-ML3.4.
E8-AH-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-0120 ensures cyber security personnel have sufficient data sources and tools to monitor systems for key indicators of compromise, which directly enables effective log review and triage. Without the data access and tooling in ISM-0120, meeting the timeliness and detection intent of E8-AH-ML3.4 is likely impractical or incomplete.
This control supports E8-AH-ML3.5.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-0120 requires cyber security personnel to have sufficient data sources and tools for monitoring systems, which includes access to endpoint log sources. E8-AH-ML3.5 is dependent on ISM-0120 for appropriate tooling and data access.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsSupports
This control supports E8-MF-ML3.4.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-0120 ensures cyber security personnel have sufficient data sources and tools to monitor for key indicators of compromise, which is a practical prerequisite to conducting timely and effective log analysis. E8-MF-ML3.4 specifies the monitoring activity, while ISM-0120 addresses capability enablement (data and tooling).
This control supports E8-MF-ML3.5.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-0120 because cyber security personnel need access to appropriate data sources and tools (e.g. SIEM, EDR consoles, query tooling) to monitor and analyse workstation log indicators of compromise in a timely manner. ISM-0120 addresses resourcing and tooling access, while E8-MF-ML3.5 specifies the operational outcome of timely workstation log analysis.
This control supports E8-RA-ML2.9.
ISM-0120 requires providing cyber security personnel with tools and data sources to monitor for indicators of compromise. E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cyber security events, which requires log availability and suitable analysis tooling for cyber security staff. E8-RA-ML2.9 mandates an analysis activity for a specific server class, while ISM-0120 addresses the prerequisite capability to perform that monitoring effectively.
This control supports E8-RA-ML3.8.
ISM-0120 requires cyber security personnel to have access to sufficient data sources and tools to monitor systems for key indicators of compromise. E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events, which depends on centralised logging access and analysis tools being available to the team. E8-RA-ML3.8 is limited to a specific log source and activity, while ISM-0120 is broader capability enablement across systems and data sources.
ASD Essentials for enterprise IT: 3 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; ISM-0120 requires cyber security personnel to have sufficient tools to detect events and identify incidents, which supports that triage.
- IT.DET-03.2Correlate signals across identities, applications, data and infrastructure to identify incidentsPartially overlaps
This control partially overlaps IT.DET-03.2.
IT.DET-03.2 requires incidents to be identified from indicators across identities, applications, data and infrastructure, not isolated signals; ISM-0120 requires cyber security personnel to have sufficient tools to detect events and identify incidents, which supports that approach.
- IT.DET-05.1Periodically review detection coverage for gaps as assets, services and architecture changePartially overlaps
This control partially overlaps IT.DET-05.1.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; ISM-0120 requires cyber security personnel to have sufficient tools to detect events and identify incidents, and those reviews help keep them sufficient.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.