ASD ISM 0634 Central logging for gateway security events
What it says
Security-relevant events for gateways are centrally logged, including: - data packets and data flows permitted through gateways - data packets and data flows attempting to leave gateways - real-time alerts for attempted intrusions.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLog gateway events and alerts to monitor data flows and detect intrusion attempts.
This control is about making sure all the important activities happening at your internet gateways are logged and tracked. By doing this, you can catch any suspicious attempts to access or send data through your network. If you skip this, you might miss warning signs of a potential data breach or hacker, which could lead to loss of sensitive information and a damaged reputation.
Free. Save your status, tasks and notes.
Why it matters
Failure to centrally log gateway packet/flow events and intrusion alerts can hide data exfiltration paths and successful intrusion attempts, increasing breach impact.
How to implement
The IT team should set up centralised logging for all gateway activities.
They can do this by using a software system that collects and stores logs from all network gateways in one place, making it easier to monitor unusual activity.
The system administration team should configure alerts for any suspicious attempts to bypass the gateway.
They can set these alerts to notify them by email or SMS whenever unusual behaviour is detected, so they can act quickly.
Managers should schedule regular reviews of the gateway logs.
They should work with IT to look at these logs to spot any trends or patterns that might suggest security issues, doing this at least once a month.
The IT team should ensure that logs are kept safely and cannot be tampered with.
This means setting permissions so that only authorised personnel can access and modify logs.
Business owners or managers should invest in training for their staff on how to recognise and report suspicious activity in the logs.
This training can be done through workshops or online modules, enhancing the organisation's overall security posture.
Keep it running
Centrally collect gateway permit/deny flow logs and intrusion alerts; regularly validate log delivery, retention, and alert tuning to detect exfiltration attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central log server's configuration report.
Look at
Details showing all gateways are configured to send their logs to the central server.
Good evidence
A documented setup that lists each gateway logging to the central system.
- Check 2 of 5What an auditor asks for
Good evidence
Logs showing a consistent format with detailed timestamped entries.
- Check 3 of 5What an auditor asks for
Ask for
The alert configuration documentation. Examine how alerts are set up and whom they notify.
Good evidence
An alert system configured to notify IT personnel in real-time with details of potential security incidents.
- Check 4 of 5What an auditor asks for
Look at
Records of meetings or reports where log data was analysed and security findings were discussed.
Good evidence
A log review schedule with meeting minutes or findings reports.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records relevant to log analysis and incident handling.
Look at
Training attendance and completion records.
Good evidence
A record showing recent training sessions attended by key staff with their names and training dates.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-0634 requires security-relevant events for gateways to be centrally logged, specifically covering permitted flows, attempted egress, and real-time intrusion alerts. Annex A 8.15 requires organisations to produce, store, protect and analyse logs for relevant activities and events across the environment. ISM-0634 is a specific application of the broader ISO logging requirement focused on gateway telemetry and centralisation.
This control supports A.8.16.
ISM-0634 requires central logging of gateway traffic and intrusion-related alerts to provide visibility of network flows through gateways. Annex A 8.16 requires monitoring of networks/systems/applications for anomalous behaviour and taking action to evaluate potential incidents. Centralised gateway logs and alerts from ISM-0634 provide key inputs that enable the anomaly detection and evaluation activities required by Annex A 8.16.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-MF-ML2.8.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-0634 requires central logging of security-relevant gateway events and real-time intrusion alerts, which are closely related to detecting attacks against internet-exposed services. They overlap on detection and log use, but ISM-0634 is gateway-centric and emphasises central logging/alerting, whereas E8-MF-ML2.8 is server-log analysis-centric.
This control supports E8-AH-ML2.15.
E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISM-0634 requires central logging of gateway security-relevant events (including intrusion alerts and permitted/attempted flows), which provides essential input data for event analysis and incident determination at the perimeter. ISM-0634 is focused on collecting and centralising gateway events, while E8-AH-ML2.15 is focused on analysing events quickly to decide whether an incident exists.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.