ASD ISM 1536Centrally Log User-Initiated Database Queries and Errors
All user-initiated database queries made by software, along with any resulting crash or error messages, are captured in centralised logs.
Plain language
This control ensures that whenever software runs a database query on behalf of a user, that query and any crash or error messages it produces are recorded in a central log. Keeping these records in one place makes it easier to spot unusual or malicious activity, investigate incidents and understand how your data is being accessed. Without central logging, suspicious queries could go unnoticed and problems would be much harder to trace.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Mar 2025
Control Stack last updated
10 Aug 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentOfficial control statement
All queries to databases from software that are initiated by users, and any resulting crash or error messages, are centrally logged.
Why it matters
Without central logging of user-initiated database queries and their errors, malicious or unauthorised data access and query failures can go undetected, leaving no reliable record to support monitoring, investigation or incident response.
Operational notes
Regularly confirm that every database and application is still shipping query and error logs, as newly added or reconfigured systems are a common source of silent logging gaps.
Implementation tips
- Database administrators enable query logging in each database management system (for example the audit log or general query log) so that every user-initiated query is recorded with a timestamp, source host and the identity of the user or application.
- Platform teams configure applications and database drivers to forward their query, crash and error events to a central logging service such as a SIEM or log aggregator, rather than leaving them only on local hosts.
- Administrators deploy a log-shipping agent (for example a syslog forwarder or logging collector) on each database and application server to stream logs to the central repository in near real time.
- Developers add database error and exception handling to software so that failed queries and crash messages are captured and sent to the same central log with enough detail to identify the query and its context.
- The logging team sets retention periods, access controls and time synchronisation (NTP) on the central log store so records are tamper-resistant, correctly time-ordered and kept for the period required by the organisation's logging policy.
Audit / evidence tips
- AskAsk which databases and applications generate user-initiated queries and how each one delivers its query logs to the central logging system.GoodEvery in-scope database and application is documented and shown to forward its query logs to a central repository with no gaps.
- AskAsk to see a sample of centrally logged user-initiated database queries from the last few days.GoodRecent user-initiated queries appear in the central log with a timestamp, the user or application identity and the query detail.
- AskAsk how database crash and error messages are captured and where they are stored.GoodCrash and error messages from failed queries are present in the central log alongside the related query activity.
- AskAsk how the completeness and reliability of database query logging is monitored.GoodActive monitoring alerts when a database or application stops sending logs, with evidence that gaps are followed up.
- AskAsk about the retention, access control and integrity protections applied to the central query logs.GoodLogs are retained for the defined period, access is restricted to authorised staff and records are protected against tampering.
Cross-framework mappings
How ISM-1536 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.9 | ISM-1536 requires implementing one defined security configuration in Microsoft Office: blocking OLE package activation | |
E8
| Control | Notes | Details |
|---|---|---|
handshakeSupports(1)expand_less | ||
| E8-AH-ML2.7 | ISM-1536 requires a specific Microsoft Office security configuration: blocking activation of OLE packages | |
linkRelated(1)expand_less | ||
| E8-AH-ML2.5 | ISM-1536 requires Microsoft Office to be configured to block activation of OLE packages to reduce exploitation of embedded objects | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.