ASD ISM 1523 Regular assessment of security events in CDS
What it says
A sample of security-relevant events relating to data transfer policies are taken at least every three months and assessed against security policies for CDSs to identify any operational failures.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvery three months, security events are reviewed to ensure CDS are working correctly and follow data transfer policies.
This control is about checking every three months that the systems used to securely transfer data are working as they should and following the rules set out for them. If this isn't done, mistakes or security issues in data transfers may go unnoticed, potentially leading to data breaches or unauthorised access to sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without quarterly sampling and assessment of CDS data-transfer events, policy failures may go unnoticed, enabling unauthorised data exfiltration or disclosure.
How to implement
IT team should schedule a quarterly review: Regularly check the logs and records from systems that transfer data to ensure they comply with security policies.
Set up a calendar reminder to perform these checks thoroughly every quarter.
Security manager should gather relevant event samples: Collect specific examples of security events related to data transfers from the logs.
This can be done by identifying and exporting security incident records and other relevant data transfer logs.
System administrator should assess the logs: Analyse and compare the event samples against the organisation's data transfer policies to check for any breaches or failures.
Use clear and simple checklists to make sure all aspects are reviewed consistently.
Compliance officer should document findings: Record the results of each review, noting any discrepancies or compliance issues found in the security events.
Use a standardised report template to ensure consistency across different time periods.
CEO or top management should be informed: Report the review outcomes, including any identified issues and corrective actions taken or required, ensuring that high-level management is aware of the system's current security posture.
Keep it running
At least every 3 months, sample CDS data-transfer events/logs and compare against transfer policies; record findings, investigate deviations, and remediate failures.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The quarterly review schedule: Request a copy of the IT department's calendar or scheduling tool.
Look at
The dates and frequency of the planned reviews.
Good evidence
A clearly defined schedule showing reviews planned every three months without gaps.
- Check 2 of 5What an auditor asks for
Ask for
Sample security event logs: Request the logs related to data transfers over the past quarter.
Look at
The types of events recorded and their relevance to data transfer policies.
Good evidence
Logs showing clear records of security events, including any abnormalities or incidents.
- Check 3 of 5What an auditor asks for
Ask for
Compliance checklists: Request the checklists used by the system administrator during their quarterly assessments.
Look at
Whether the checklists cover all required policy areas.
Good evidence
Detailed checklists with all necessary policy checks completed and marked.
- Check 4 of 5What an auditor asks for
Ask for
Review reports: Request the documented findings from past quarterly reviews.
Look at
The details of the findings and any actions documented.
Good evidence
Comprehensive review reports showing issues identified and corrective actions implemented.
- Check 5 of 5What an auditor asks for
Ask for
Management communication: Request evidence of communication with top management about review outcomes.
Look at
Whether management was informed and action items were noted.
Good evidence
Emails or briefing documents showing clear communication of results and planned actions.
Mappings
Closest match in ISO/IEC 27001: A.5.36, Review compliance with information security policies, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.36.
ISM-1523 requires a three‑monthly review of a sample of CDS security-relevant events against data transfer security policies to identify operational failures. Annex A 5.36 requires regular reviews of compliance with the organisation's information security policies, topic-specific policies, rules and standards, which can include transfer policies and operational monitoring outputs. ISM-1523 is a specific, prescriptive compliance review method (event sampling for CDS transfers) that would sit within the broader compliance-review expectation of Annex A 5.36.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.