Skip to content
Data transfers
ASD ISMISM-1294

ASD ISM 1294 Partial monthly verification of data transfer logs

What it says

Data transfer logs for systems are partially verified at least monthly.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Data transfer logs are checked monthly to ensure some accuracy and compliance.

Data transfer logs need to be reviewed at least once a month to make sure they're accurate and follow legal rules. This is important because if these logs aren't checked, businesses might miss errors or breaches, leading to possible legal issues and security risks.

Why it matters

Failing to verify data transfer logs monthly can miss unauthorised transfers or errors, causing data breaches and regulatory non-compliance.

How to implement

  1. A data officer should take responsibility for organising the monthly checks of data transfer logs.

    They can do this by setting a reminder in a calendar and gathering the necessary logs from all relevant systems.

  2. An IT professional should assess the accuracy of the logs by comparing the recorded transfers against a list of authorised transfers.

    They should highlight any discrepancies for further investigation.

  3. A compliance officer should coordinate with the IT team to ensure that all logs are being reviewed for compliance with legal standards such as the Privacy Act.

    This can be done by checking against current legal requirements and guidelines.

  4. The management team should schedule regular training sessions for staff involved in data handling to ensure they understand the importance of accurate logging and compliance.

    Such sessions can include workshops or online modules.

  5. The IT team should set up automated alerts to flag unusual or unexpected log entries that might indicate a problem.

    They can use simple scripts or software tools that are user-friendly and don't require advanced programming skills.

Keep it running

Schedule partial verification of data transfer logs at least monthly; record results, retain evidence, and investigate anomalies or unexpected transfer volumes promptly.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The monthly review schedule of data transfer logs: Confirm that there is a documented plan showing when and who reviews each system's logs.

    Look at

    A calendar or log with past review dates.

    Good evidence

    Includes clear dates and assigned reviewers.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see the results of a recent log review: Request a report that summarises the findings of a monthly log review.

    Look at

    How discrepancies were handled.

    Good evidence

    Shows identified issues and documented resolutions.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The compliance check documentation: Request evidence that logs were checked against compliance standards.

    Look at

    Annotations or tick marks next to each legal requirement.

    Good evidence

    Includes compliance notes and identified gaps.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Training records regarding data handling: Request documentation of any training sessions held for staff involved in data transfer logging.

    Look at

    Attendance sheets and training materials.

    Good evidence

    Includes recent training dates and topics covered.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A list of authorised data transfers: Request documentation that lists all standard, expected data transfers.

    Look at

    How this list is referenced during monthly log reviews.

    Good evidence

    Shows consistent cross-referencing and updates.

Mappings

Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.15Logging of activities and eventsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.