ASD ISM 1228 Analyse cyber security events promptly
What it says
Cyber security events are analysed in a timely manner to identify cyber security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTimely analysis of security events to spot incidents.
This control is about quickly looking at any signs of unusual activity on your computers and networks to see if there might be a security problem. It's important because if you miss or overlook these signs, you might not catch a cyber incident before it causes real harm, like data breaches or system downtime.
Free. Save your status, tasks and notes.
Why it matters
Delayed event analysis can let genuine incidents go unnoticed, increasing dwell time and the likelihood of data compromise, loss and reputational harm.
How to implement
IT staff should set up automatic alerts for unusual activities: Use software to monitor systems for anything odd, like too many login attempts or unexpected data transfers.
The software should notify the IT team right away so they can check if it's something suspicious.
Managers should ensure the IT team has the resources they need: Make sure they have the right tools and enough staff time to monitor alerts.
Consider budgeting for training and software that helps in detecting issues quickly.
System owners should have clear procedures in place: Develop a step-by-step guide on what to do when a suspicious event is detected.
This should cover who to inform, what information to gather, and how to assess the seriousness of the threat.
The IT team should conduct regular training sessions: Train staff on what unusual activity looks like and how to report it.
Use real-world examples to make the training more effective and relatable.
Assign a point of contact for security incidents: Designate a person or team who is responsible for handling incidents when detected.
Ensure this information is communicated so everyone knows who to contact when something unusual is found.
Keep it running
Review key security logs daily (or continuously), tune alert rules, and use SIEM automation to triage events quickly and escalate suspected incidents within defined SLAs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The logs of security alerts: Request records showing the alerts generated and how they were followed up.
Look at
The details of the alerts and the timeliness of responses.
Good evidence
Alerts are reviewed promptly and documented follow-ups show the outcome.
- Check 2 of 5What an auditor asks for
Ask for
The incident response plan: Request the document outlining how the organisation handles detected incidents.
Look at
Clear roles, responsibilities, and a process flow.
Good evidence
The document is comprehensive, up-to-date, and practised regularly.
- Check 3 of 5What an auditor asks for
Ask for
Training records for IT staff: Request evidence of regular training sessions pertaining to identifying and responding to cyber events.
Look at
The content and frequency of training.
Good evidence
Training is relevant, regular, and includes all necessary personnel.
- Check 4 of 5What an auditor asks for
Ask for
Software tool reports: Request reports from tools that monitor for unusual activity.
Look at
Evidence that these tools are set up correctly and actively used.
Good evidence
Reports show active monitoring, regular updates, and correct configurations.
- Check 5 of 5What an auditor asks for
Ask for
To see results of recent incident testing exercises: Request documentation of any simulations or tests performed to assess the response to cyber events.
Look at
Issues identified and any improvements made as a result.
Good evidence
Simulations are conducted effectively, with actionable insights and noted improvements.
Mappings
Closest match in ISO/IEC 27001: A.5.25, Assessment and decision on information security events, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control is equivalent to A.5.25.
ISM-1228 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 5.25 requires the organisation to assess information security events and decide whether they are to be categorised as incidents, which is the same core requirement. Both controls centre on event assessment/triage and the event-to-incident decision.
This control depends on A.8.15.
ISM-1228 requires organisations to analyse cyber security events promptly to identify incidents. Annex A 8.15 requires logs to be produced, stored, protected and analysed, providing the core telemetry and integrity needed for reliable event analysis. In practice, effective implementation of ISM-1228 depends on Annex A 8.15-like logging being in place so that there are trustworthy events to analyse in the first place.
ASD Essential Eight: 16 mappings
This control is equivalent to E8-AC-ML2.8.
ISM-1228 requires cyber security events to be analysed promptly so that incidents are identified. E8-AC-ML2.8 states the same requirement in essentially the same terms (timely analysis of cyber security events to identify incidents). There is no meaningful scope or intent difference between ISM-1228 and E8-AC-ML2.8.
This control is equivalent to E8-AH-ML2.15.
E8-AH-ML2.15 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1228 states the same requirement with the same intent and outcome (rapid analysis to determine whether an event is an incident). Implementing ISM-1228 would largely satisfy E8-AH-ML2.15 because both focus on timely event analysis and incident identification.
This control is equivalent to E8-MF-ML2.9.
E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify incidents quickly. ISM-1228 states the same requirement, using effectively identical scope and intent around timely event analysis leading to incident identification. Implementing ISM-1228 would largely satisfy E8-MF-ML2.9 and vice versa.
This control is equivalent to E8-RA-ML2.10.
ISM-1228 requires timely analysis of cyber security events to determine whether they constitute incidents. E8-RA-ML2.10 matches this requirement directly by mandating timely analysis of cyber security events to identify incidents. Both controls focus on the analysis/triage step between 'event' and 'incident'.
This control is broader than E8-AC-ML3.5.
E8-AC-ML3.5 requires organisations to promptly analyse workstation event logs to detect cyber security events. ISM-1228 requires timely analysis of cyber security events to determine whether they constitute incidents, which can be informed by workstation log review. The overlap is that workstation log analysis under E8-AC-ML3.5 feeds the event analysis process in ISM-1228, but ISM-1228 is broader because it covers event triage/analysis across all sources, not just workstation logs.
This control is broader than E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1228 is broader because it requires cyber security events (from any source) to be analysed in a timely manner to identify incidents, not limited to a particular log source or asset type. E8-AH-ML2.14 is a specific implementation pathway that supports meeting ISM-1228 for the internet-facing server logging stream.
This control is broader than E8-AH-ML3.4.
E8-AH-ML3.4 requires timely analysis of event logs specifically from non-internet-facing servers to detect cyber security events. ISM-1228 is broader, requiring cyber security events to be analysed in a timely manner to identify incidents, without limiting to a particular log source or asset class. E8-AH-ML3.4 can be seen as a specific implementation path that contributes evidence and detection input into the broader analysis process described by ISM-1228.
This control is broader than E8-RA-ML2.9.
E8-RA-ML2.9 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1228 is broader, requiring cyber security events (from any source) to be analysed in a timely manner to identify incidents, not limited to logs or internet-facing servers. E8-RA-ML2.9 is a specific log-focused detection requirement that feeds into the broader analysis obligation in ISM-1228.
This control partially meets E8-AC-ML3.4.
E8-AC-ML3.4 requires timely analysis of non-internet-facing server event logs to detect cyber security events. ISM-1228 is broader, requiring cyber security events to be analysed in a timely manner to identify incidents, regardless of event source. E8-AC-ML3.4 is one source for such events.
This control partially meets E8-AH-ML3.5.
E8-AH-ML3.5 requires analysing workstation event logs in a timely manner to detect cyber security events. ISM-1228 is broader because it requires cyber security events (from any source) to be analysed in a timely manner to determine whether they constitute incidents. E8-AH-ML3.5 is one important input to ISM-1228 (workstation-derived events), but ISM-1228 also covers analysis beyond log review and across more sources.
This control partially meets E8-MF-ML2.8.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1228 is broader, requiring cyber security events to be analysed in a timely manner to identify incidents, regardless of the source of the event data. E8-MF-ML2.8 fits within ISM-1228 as a specific log-driven detection and analysis activity for a defined system category.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsPartially meets
This control partially meets E8-MF-ML3.4.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1228 is broader because it requires cyber security events from any source to be analysed in a timely manner to identify incidents, not limited to server logs or to non-internet-facing systems. E8-MF-ML3.4 is a specific implementation focus that supports meeting the wider event-to-incident analysis expectation in ISM-1228.
This control partially meets E8-RA-ML3.9.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1228 is broader because it requires timely analysis of cyber security events generally (regardless of source) to identify incidents, which could include workstation-derived events plus other detection inputs. E8-RA-ML3.9 is a specific log-source-focused implementation that contributes to meeting ISM-1228 but does not cover all event sources or the full incident identification activity.
This control supports E8-MF-ML2.11.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-1228 is a prerequisite because events must be analysed in a timely manner to identify which events are incidents that warrant ASD reporting. Without ISM-1228-style analysis and triage, organisations may not reliably discover incidents quickly enough to meet E8-MF-ML2.11 time expectations.
This control supports E8-MF-ML3.5.
E8-MF-ML3.5 requires workstation event logs to be analysed in a timely manner to detect cyber security events. ISM-1228 focuses on timely analysis of cyber security events to determine whether they constitute incidents, which is an escalation/triage step that commonly consumes workstation log findings. The ISM control is broader in scope (all event sources and incident identification), while E8-MF-ML3.5 is a specific detection activity for the workstation log source.
This control depends on E8-AH-ML2.12.
E8-AH-ML2.12 requires centralised logging of command line process creation events so that execution activity is available for monitoring. ISM-1228 requires cyber security events to be analysed in a timely manner to identify incidents, which depends on having relevant logs available. E8-AH-ML2.12 supports ISM-1228 by improving visibility for analysis, but it does not itself require analysis workflows or timeliness.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.