ASD ISM 0582 Central logging of Windows security events
What it says
Security-relevant events for Microsoft Windows operating systems are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImportant Windows security events are collected in a central location to monitor system activities.
This control means collecting important security events from all Windows computers in one central spot. It's like having a single dashboard to see any unusual activity on your systems. If you don't do this, you might miss signs that someone is trying to hack into your network, which could lead to data breaches or other security problems.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of Windows Security events (e.g., logons, privilege use), attacks may not be correlated across hosts, delaying response and increasing breach likelihood.
How to implement
IT team: Gather up event logs from all Windows computers in your network and send them to a central logging system.
Use a program or tool specifically designed for this task so that it automatically collects and aggregates logs, making sure nothing is missed.
System administrator: Set up alerts for specific security events that could indicate an issue, like a failed login attempt or changes to important system files.
Use the logging system's alert features to be notified immediately when suspicious activity occurs.
IT manager: Ensure the central logging system is properly secured and only accessed by authorised personnel.
Set access controls so that only people who need to see these logs can access them, reducing the risk of insider threats.
Security officer: Regularly review the central logs for patterns of unusual activity.
Look through the logs on a weekly basis to identify any trends or recurring issues that may need further investigation.
Training coordinator: Provide training for staff responsible for monitoring and interpreting the logs.
Organise sessions to teach them what to look for and how to respond to different types of security events.
Keep it running
Configure Windows Security Event Log forwarding (e.g., WEF/agent) to a central SIEM, validate coverage, and alert on failed logons, privilege changes and audit policy tampering.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Central logging system access logs.
Look at
The list of users who have access and their activity records.
Good evidence
Only authorised personnel accessed the logs; no unusual access patterns appear.
- Check 2 of 5What an auditor asks for
Ask for
Configuration settings of the logging tool.
Look at
Settings showing automated collection of logs from all Windows systems.
Good evidence
Configuration confirms logs are gathered and sent centrally without omissions.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of security event alerts setup.
Look at
Screenshots or reports showing alert configurations.
Good evidence
Clear trigger events for alerts, like multiple failed logins and key system file changes, are in place.
- Check 4 of 5What an auditor asks for
Ask for
Recent incident response records.
Look at
Details on how alerts were handled.
Good evidence
Documented responses show quick action taken on logged security events, with outcomes recorded.
- Check 5 of 5What an auditor asks for
Ask for
Training records for logging system handlers.
Look at
Attendance records and training materials.
Good evidence
Staff attended training sessions and can demonstrate knowledge of system use and security response procedures.
Mappings
Closest match in ISO/IEC 27001: A.8.16, Monitoring networks and systems for anomalous behaviour, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.8.16.
Annex A 8.16 requires ongoing monitoring for anomalous behaviour across networks and systems and taking action to evaluate potential incidents. ISM-0582 relates by requiring central logging of security-relevant Windows events, which provides a core telemetry source for detecting anomalies and investigating incidents. Annex A 8.16 is broader because it does not prescribe central logging and covers monitoring and response actions across all platforms, not only Windows.
This control partially meets A.8.15.
ISM-0582 stipulates centrally logging security-relevant events on Windows systems. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring organisations to manage logs for all relevant events across systems/ applications. ISM-0582 is a specific technical implementation pattern within Annex A 8.15's wider logging governance.
ASD Essential Eight: 6 mappings
This control is broader than E8-AH-ML2.12.
E8-AH-ML2.12 requires centralised logging of command line process creation events to improve visibility of execution behaviour. ISM-0582 requires central logging of security-relevant events for Microsoft Windows operating systems, which commonly includes Windows process creation and command line auditing where configured. ISM-0582 provides the OS-level log source coverage that helps implement E8-AH-ML2.12 on Windows, but it is broader than command line process creation alone.
This control partially overlaps E8-AC-ML2.6.
ISM-0582 requires security-relevant Windows events to be centrally logged. E8-AC-ML2.6 overlaps by requiring logs be protected from unauthorised change, a key integrity measure for centralised logging. ISM-0582 covers central collection, while E8-AC-ML2.6 covers log safeguarding, addressing different aspects of logging controls.
- E8-AH-ML2.11Centrally log PowerShell module, script block, and transcription eventsPartially overlaps
This control partially overlaps E8-AH-ML2.11.
ISM-0582 mandates central logging of security-relevant events on Microsoft Windows. E8-AH-ML2.11 overlaps by requiring PowerShell logs, which are Windows-host telemetry, to be centrally collected. E8-AH-ML2.11 is more specific about enabling PowerShell logging, while ISM-0582 is broader but less prescriptive about Windows subcomponents like PowerShell.
This control partially overlaps E8-AH-ML2.13.
ISM-0582 requires central logging of security-relevant events for Windows. E8-AH-ML2.13 relates by protecting event logs from modification, necessary to ensure logged Windows events remain trustworthy. ISM-0582 addresses log collection, while E8-AH-ML2.13 assures log integrity.
This control partially overlaps E8-RA-ML2.6.
ISM-0582 requires that security-relevant events for Microsoft Windows operating systems are centrally logged. E8-RA-ML2.6 relates by requiring privileged access events (which include Windows security logs such as logon, privilege use and account management) to be centrally collected. ISM-0582 is broader in Windows event coverage, while E8-RA-ML2.6 is narrower and focused specifically on privileged access telemetry.
This control supports E8-MF-ML3.5.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-0582 because central logging of Windows security events provides the consolidated, reliable workstation security event data needed to enable efficient analysis at scale. ISM-0582 focuses on collection/centralisation, while E8-MF-ML3.5 focuses on timely analytical review for detection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.