ASD ISM 0660 Monthly verification of data transfer logs for SECRET systems
What it says
Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck logs every month to ensure safe data transfers in top-secret systems.
This control ensures that the logs of data transfers in top-secret systems are checked every month. Doing this is important because it helps catch and fix any issues early. If these logs aren't reviewed, sensitive information could be at risk of being stolen or misused without anyone knowing.
Free. Save your status, tasks and notes.
Why it matters
If monthly verification of SECRET/TOP SECRET data transfer logs is not performed, unauthorised transfers may go undetected, enabling classified data exfiltration and national security compromise.
How to implement
The IT manager should assign a team member to check the data transfer logs monthly.
They should make it part of their routine to review these logs for any unusual activity or errors.
The system administrator should ensure the logs are stored securely and are easily accessible for review.
They could use a shared folder with restricted access so only authorised personnel can view the logs.
The compliance officer should schedule a monthly reminder to check that the log reviews are taking place and documented.
Using a calendar alert can help ensure this task isn't forgotten.
System owners should establish a clear process for what to do if suspicious activity is found in the logs.
This could involve contacting the IT team's security expert or following a set protocol.
The office manager should support by ensuring the IT team has the resources and time needed to conduct the log reviews.
This might involve adjusting workloads or providing training.
Keep it running
Monthly, fully verify SECRET/TOP SECRET transfer logs by reconciling each entry to approvals and endpoints; investigate anomalies (unexpected destinations, volume spikes, failures) and retain evidence of completion.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The monthly log review report: Request the document showing the logs were reviewed.
Look at
The review dates and any noted issues: Check the document for dates when reviews happened and any comments about problems that were found.
Good evidence
Would be a report listing review dates and any necessary follow-up actions to address issues found.
- Check 2 of 4What an auditor asks for
Ask for
The procedure document on log reviews: Request the document detailing how these reviews should be conducted.
Look at
Who is responsible and what steps are involved: Check if there's clarity on roles and specific steps to be taken during the reviews.
Good evidence
Shows clearly defined responsibilities and step-by-step instructions for the review process.
- Check 3 of 4What an auditor asks for
Ask for
Any incident reports resulting from log review findings: Request documentation of any suspicious activities discovered.
Look at
The action taken and the resolution: Check if appropriate and timely actions were taken when issues were identified.
Good evidence
Details the incidents discovered, actions taken, and how they were resolved.
- Check 4 of 4What an auditor asks for
Ask for
Evidence of training provided to staff conducting reviews: Request records showing training sessions or materials about reviewing logs.
Look at
Attendance records or training materials: Check that the people assigned to review logs have received appropriate training.
Good evidence
Includes dates, participant names, and content covered in training sessions.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-0660 requires organisations to fully verify data transfer logs for SECRET and TOP SECRET systems at least monthly to ensure authorised and appropriate information movement. This supports Annex A 5.14 because information transfer policies and procedures should define approved transfer methods and associated monitoring/record-keeping that produce the logs ISM-0660 then verifies. Annex A 5.14 is broader (rules, agreements and procedures for all transfer types), while ISM-0660 is a specific assurance activity targeted at classified-system transfer logs and a defined verification frequency.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.