ASD ISM 0670 Central logging of CDS security events
What it says
Security-relevant events for CDSs are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all key security events of Cross Domain Solutions are logged centrally for monitoring.
This control is about making sure all important security events happening in systems that allow data exchange across different security domains are recorded centrally. It's important because if these events aren't monitored, suspicious or harmful activities might go unnoticed, risking data theft or breaches.
Free. Save your status, tasks and notes.
Why it matters
If CDS security events are not centrally logged, incidents can be missed, delaying response and enabling cross-domain unauthorised access or data compromise.
How to implement
IT team should set up centralised logging: Make sure that all security events from cross domain solutions (CDS) are sent to a single, central system for easy monitoring.
Use logging software that can collect and store these events securely.
System owners should review logs regularly: Schedule time to look at the logs at least once a week to spot anything unusual.
Focus on patterns that might indicate security issues, such as repeated failed login attempts or transfers of large volumes of data.
Managers should coordinate with IT: Ensure that the IT team knows exactly which events must be logged and understands the importance of these logs.
Clearly communicate the types of security events relevant to your organisation's operations.
HR should assist with training: Provide training sessions for employees to help them recognise and report security events promptly.
This helps in gathering comprehensive logs that include both automated and human-detected incidents.
Procurement should acquire the right tools: Work with the IT team to choose and purchase reliable logging tools that integrate well with current systems.
Consider solutions that meet Australian Cyber Security Centre (ACSC) and Australian Signals Directorate (ASD) guidelines.
Keep it running
Configure CDSs to forward security event logs to a central SIEM/syslog service and enable alerting; review and investigate CDS log events at least weekly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The logging policy document: Request the organisation's policy outlining which events must be logged and how they are stored.
Look at
Whether the policy is up-to-date and matches your business size and nature.
Good evidence
Will detail specific logging requirements and a review schedule.
- Check 2 of 5What an auditor asks for
Ask for
Recent log files: Request a recent example of logged events from the central system.
Look at
The types of events that are recorded and whether they cover security-critical activities.
Good evidence
Will show a diverse range of events including both successful and failed actions.
- Check 3 of 5What an auditor asks for
Ask for
Who reviews the logs: Find out which person or team is responsible for checking the logs regularly.
Look at
Whether there is a clear process for log review and incident reporting.
Good evidence
Will confirm that the logs are reviewed regularly by appointed personnel.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request evidence of employee training sessions on recognising and reporting security events.
Look at
Attendance records and training materials.
Good evidence
Shows consistent and comprehensive training with good engagement.
- Check 5 of 5What an auditor asks for
Ask for
IT procurement records: Request documents showing the purchase of logging tools.
Look at
Whether the tools are suitable for your organisation's needs and comply with Australian security standards.
Good evidence
Will have details on the selection process and tool capabilities.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.5, Allowed and blocked application control events are centrally logged, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-0670 requires security-relevant events for CDSs to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 relates by requiring logs of relevant events to be produced, stored, protected, and analysed across the organisation. ISM-0670 is narrower because it is specific to CDSs and emphasises central logging, whereas Annex A 8.15 is broader and includes protection and analysis in addition to creation and storage.
ASD Essential Eight: 2 mappings
This control is broader than E8-AC-ML2.5.
ISM-0670 requires security-relevant events for Cross Domain Solutions (CDSs) to be centrally logged for monitoring. E8-AC-ML2.5 relates by mandating central logging specifically for allowed and blocked application control events, which are a subset of security events a CDS environment may generate. E8-AC-ML2.5 is narrower because it is limited to application control events, while ISM-0670 is CDS-wide and not event-type specific.
This control is broader than E8-AH-ML2.12.
ISM-0670 requires central logging of security-relevant events for CDSs. E8-AH-ML2.12 relates by centralising command line process creation logs, which can be a critical security signal on CDS hosts and supporting systems. E8-AH-ML2.12 is narrower because it is limited to one telemetry type, while ISM-0670 applies broadly to CDS security events.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.