ASD ISM 1405 Implement a centralised event logging facility
What it says
A centralised event logging facility is implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all event logs are collected and managed in one central location for analysis and security monitoring.
Having a central spot where all your system's event logs are gathered is like having a single bulletin board where you can track everything going on in your business. This matters because if you can't see what's happening across all your systems, you might miss warning signs of a security threat or system issue, which could cost you time, money, or damage your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without a centralised event logging facility, security events are fragmented across systems, delaying detection and investigation of suspicious activity and increasing incident impact.
How to implement
The IT team should set up a centralised logging system.
Start by choosing a tool that collects logs from all your systems into one place-this could be software that runs on your server or a cloud-based service. Ensure it can handle the volume of logs your organisation generates.
System administrators should configure each system to send logs to the central logging facility.
Check the system's settings to find how to export logs and use the provided documentation to route these to the central logging system.
Managers should inform staff about the importance of logging certain events.
Schedule training sessions to teach employees what activities must be logged and the importance of these logs to the organisation's security and operations.
The security team should analyse the collected logs regularly.
Use the central logging system's analysis features to look for patterns or unusual activities that could indicate a threat or issue.
IT support staff should maintain the logging system.
Regularly check that logs from all systems are being received correctly and troubleshoot any issues promptly, ensuring the system's centralised nature remains intact.
Keep it running
Centralise logs from key systems, normalise formats, and enforce time synchronisation (NTP). Monitor and alert regularly, and set retention to support investigations and trend analysis.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A document listing all systems connected to the central logging facility.
Look at
The list to ensure it covers all critical systems used by the organisation.
Good evidence
Is a comprehensive list with all business systems included and an assigned date for each connection.
- Check 2 of 5What an auditor asks for
Good evidence
Result shows logs originating from different systems consistently over recent periods.
- Check 3 of 5What an auditor asks for
Ask for
The log analysis reports.
Look at
When these reports were last reviewed and by whom.
Good evidence
Includes up-to-date reports that have been reviewed regularly by the named security team members.
- Check 4 of 5What an auditor asks for
Good evidence
Is a completed training register that links the training to improved logging practices.
- Check 5 of 5What an auditor asks for
Ask for
The system maintenance records for the logging facility. Ensure these logs show regular checks and prompt addressing of issues.
Good evidence
Result shows routine maintenance entries and quick resolution of any problems.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.12, Command line process creation logging is centralised, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.15.
ISM-1405 requires a centralised event logging facility to collect and manage event logs in one location. Annex A 8.15 requires logs to be produced, stored, protected and analysed, which commonly includes centralised log collection as part of storage and analysis. Annex A 8.15 is broader because it covers the full logging lifecycle (generation, protection and analysis), while ISM-1405 focuses specifically on the centralised facility component.
ASD Essential Eight: 8 mappings
This control is broader than E8-AH-ML2.12.
E8-AH-ML2.12 requires centralised logging specifically for command line process creation events. ISM-1405 requires implementation of a centralised event logging facility that can ingest logs from multiple sources across the environment. E8-AH-ML2.12 is a specific use case that would be implemented within the broader capability mandated by ISM-1405.
This control is broader than E8-MF-ML2.6.
ISM-1405 requires a centralised event logging facility so authentication and other security-relevant logs can be collected in one location. E8-MF-ML2.6 directly relates by requiring MFA success and failure events to be centrally logged. The candidate is narrower as it addresses only MFA outcomes, while ISM-1405 is about centralising event logs across the environment.
This control supports E8-AC-ML2.5.
E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged. ISM-1405 requires that a centralised event logging facility is implemented, which is the foundational capability needed to satisfy E8-AC-ML2.5 at scale. E8-AC-ML2.5 is specific to application control events, while ISM-1405 is a general prerequisite for central logging across event sources.
This control supports E8-AH-ML2.11.
E8-AH-ML2.11 requires PowerShell module, script block, and transcription events to be centrally logged. ISM-1405 requires implementation of a centralised event logging facility, which E8-AH-ML2.11 depends on to actually collect and retain those PowerShell events in a central location. ISM-1405 is broader and does not prescribe which events to log, whereas E8-AH-ML2.11 specifies the PowerShell event types that must feed into the central facility.
This control supports E8-MF-ML2.8.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1405 mandates implementing a centralised event logging facility, which underpins timely analysis by aggregating, protecting and making logs available for review and correlation. E8-MF-ML2.8 is the operational detection activity, while ISM-1405 is foundational logging infrastructure that is typically a prerequisite for doing it consistently.
This control supports E8-MF-ML3.5.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-1405 because implementing a centralised event logging facility commonly underpins timely log analysis by enabling aggregation, correlation and efficient review workflows. ISM-1405 is about establishing the logging platform capability, whereas E8-MF-ML3.5 is about performing timely analysis of workstation logs.
This control supports E8-RA-ML2.7.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-1405 requires an organisation to implement a centralised event logging facility, which is a foundational capability needed to centralise logs from identity and directory services. In practice, E8-RA-ML2.7 is difficult to implement consistently without first having the central logging facility mandated by ISM-1405.
This control depends on E8-AC-ML2.6.
E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion. ISM-1405 implements a centralised event logging facility, which supports E8-AC-ML2.6 by reducing the ability of attackers or local administrators to tamper with logs on individual endpoints and by enabling stronger access control and retention controls on the logging platform. Centralisation helps but does not, by itself, guarantee immutability or prevent authorised-but-inappropriate deletion without additional access and retention safeguards.
ASD Essentials for enterprise IT: 3 mappings
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes to be forwarded to central log storage; ISM-1405 requires a centralised event logging facility to be implemented, the destination that forwarding relies on.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingPartially overlaps
This control partially overlaps IT.DET-01.3.
IT.DET-01.3 requires a centralised event log storage capability that protects logs from unauthorised access or modification; ISM-1405 requires a centralised event logging facility to be implemented, the core of that action without its protection requirement.
- IT.DET-02.1Normalise, time-synchronise and enrich event logs for cross-system correlationPartially overlaps
This control partially overlaps IT.DET-02.1.
IT.DET-02.1 requires event logs to be normalised, time-synchronised and enriched to support correlation across systems and environments; ISM-1405 requires a centralised event logging facility, which supports that correlation by bringing logs together in one place.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.