ASD ISM 1537 Log security-relevant database events centrally
What it says
Security-relevant events for databases are centrally logged, including: - access or modification of particularly important content - addition of new users, especially privileged users - changes to user roles or privileges - attempts to elevate user privileges - queries containing comments - queries containing multiple embedded queries - database and query alerts or failures - database structure changes - database administrator actions - use of executable commands - database logons and logoffs.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep track of important activities in databases, like access, changes, and issues, to ensure security.
This control means you need to keep a central log of important activities happening in your databases, like whenever someone accesses, changes, or tries to break into them. If you don't do this, you might miss signs of a security breach, like someone stealing sensitive information or causing damage, which could lead to financial loss or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of security-relevant database events, unauthorised access, privilege escalation, schema changes or admin actions may go undetected, enabling data breaches.
How to implement
The IT team should set up a central logging system to capture database events.
They can use existing software that records and centralises logs from various databases so that all important actions are in one place.
Database administrators should ensure that logs include specific events like adding new users or changes in user privileges.
They can configure the logging settings of their database software to capture these crucial actions.
Managers should regularly review logs or reports generated from the central logging system.
They can set a schedule for routine checks, focusing on unusual access patterns or attempts to change security settings.
System owners should collaborate with the IT team to ensure that any updates in database software still comply with logging requirements.
This can involve testing to confirm that logging of critical events continues uninterrupted after updates.
Human Resources and IT should work together to ensure anyone accessing databases understands their actions will be logged.
This can be done through training sessions and updating employment contracts to include security compliance clauses.
Keep it running
Centrally collect DB audit logs for logons/logoffs, role/privilege changes, admin actions, schema changes and failed alerts; validate ingestion and retention for investigations.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central log configuration documentation: Request the technical manual or system setup guide that explains how database events are logged.
Look at
Whether the document covers all the events specified in the control. Good documentation will show comprehensive coverage with clear steps on setting up and maintaining the log.
- Check 2 of 5What an auditor asks for
Ask for
Recent log review meeting minutes: Request the notes or minutes from meetings where logs were reviewed.
Look at
The frequency and content of these meetings, checking for discussions on unusual or critical events.
Good evidence
Document reflects regular reviews and actionable decisions made from log insights.
- Check 3 of 5What an auditor asks for
Ask for
A sample of recent logs: Request a report or printout capturing a week's worth of logged database events.
Look at
The types of events logged and whether they include accesses, modifications, and login activities.
Good evidence
Sample will show detailed and varied activity logging, matching security requirements.
- Check 4 of 5What an auditor asks for
Ask for
A list of database administrators and their training records.
Look at
Training materials or certificates proving administrators understood logging procedures. Good training records will show recent dates and a clear focus on this control's requirements.
- Check 5 of 5What an auditor asks for
Ask for
An incident response plan that involves log analysis: Request the document detailing what happens when a security incident is suspected.
Look at
Steps that include examining database logs.
Good evidence
Plan will be clear on using logs to detect and understand incidents.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
ISM-1537 requires organisations to centrally log a defined set of security-relevant database events (e.g. privileged changes, key content access/modification, DBA actions, logons/logoffs, and risky query patterns). Annex A 8.15 requires logs of relevant activities/events to be produced, stored, protected and analysed across the organisation's systems. ISM-1537 is a specific database-focused instantiation of the broader ISO logging requirement, with more prescriptive database event categories.
This control supports A.5.28.
ISM-1537 requires organisations to centrally log security-relevant database events so that database activity can be reconstructed and reviewed. Annex A 5.28 focuses on procedures to identify, collect and preserve evidence for information security events. Centralised database logging under ISM-1537 directly strengthens the ability to collect reliable database evidence, but 5.28 adds chain-of-custody and preservation processes not covered by ISM-1537.
This control supports A.8.16.
ISM-1537 requires organisations to centrally log a rich set of database security events so suspicious activity and misuse can be detected and investigated. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate incidents. Centralised, high-fidelity database logs from ISM-1537 provide critical telemetry to enable the anomaly detection and investigation activities expected by Annex A 8.16, but 8.16 also covers response actions and broader monitoring beyond databases.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-RA-ML2.6.
ISM-1537 requires organisations to centrally log security-relevant database events, including privileged user activity such as DBA actions and privilege elevation attempts. E8-RA-ML2.6 requires privileged access events to be centrally logged across environments. They overlap on privileged activity logging, but ISM-1537 is database-specific and also includes non-privileged database events (e.g. structure changes, query patterns, alerts/failures) that E8-RA-ML2.6 does not specify.
- E8-RA-ML2.7Centrally log privileged user account and security group management eventsPartially overlaps
This control partially overlaps E8-RA-ML2.7.
E8-RA-ML2.7 requires central logging of privileged account and group management events. ISM-1537 requires central logging of security-relevant database events, including adding privileged users and changing roles/privileges, which can include privileged identity management within database platforms. ISM-1537 is database-specific and broader across many database event types, while E8-RA-ML2.7 is focused on privileged account/group management events across the environment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.