ASD ISM 1573 Log access documentation with service providers
What it says
Access to all logs relating to an organisation's data and services is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure contracts specify how organisations can access logs about their data from service providers.
This control requires that when you sign contracts with service providers, you make sure there is a clear agreement on how you can access the logs related to your data. If you don't have access to these logs, you might not be able to detect or trace security incidents, which could lead to data breaches or loss without you even knowing it.
Free. Save your status, tasks and notes.
Why it matters
If log access rights aren't documented in service provider contracts, you may be unable to obtain audit logs, delaying breach detection, investigation and compliance reporting.
How to implement
Business Manager should ensure: When negotiating contracts with service providers, include a clause that details your right to access data logs.
Work with your legal adviser to make sure these requirements are clearly stated in all agreements.
Procurement team should ensure: Before finalising any service provider contracts, review the draft to check if it includes clear provisions for log access.
Collaborate with the IT team to understand what specific log access is required for your systems.
IT Manager should ensure: Provide a list of required log types to the procurement or legal team to help them negotiate contracts.
This list should include logs for access events, changes, and data transfers related to your systems.
Legal Adviser should ensure: Review and update standard contract templates to include specific language about log access rights.
This includes specifying how often logs should be available, the format, and any costs associated with accessing them.
System Owner should ensure: Once contracts are in place, regularly verify with service providers that log access is functioning as expected.
Schedule periodic checks to ensure that you can access the logs as per the agreed terms.
Keep it running
Document in contracts who can access which service/provider logs, how access is provided, retention periods, and timeframes for log delivery to support audits and investigations.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the contract with the service provider: Request to see the section detailing log access provisions.
Look at
Clauses that specify your rights to access logs related to your data and systems.
Good evidence
Contracts explicitly mention log access details, frequency, and cost.
- Check 2 of 5What an auditor asks for
Ask for
Meeting notes with legal or procurement teams: These should cover discussions about contract negotiations for log access.
Look at
Mentions of specific log access needs and how they were addressed.
Good evidence
Documented evidence of addressing and resolving log access requirements.
- Check 3 of 5What an auditor asks for
Ask for
Access request logs: Request records showing how often logs were accessed and by whom.
Look at
Timestamps and the nature of the logs being accessed.
Good evidence
Regularly accessed logs with proper documentation and approval.
- Check 4 of 5What an auditor asks for
Ask for
A log access policy or procedure document: Verify that there is a written process for accessing logs from service providers.
Look at
Clear steps on who to contact and action timelines.
Good evidence
A comprehensive document that guides log access requests and procedures.
- Check 5 of 5What an auditor asks for
Ask for
To speak with the IT team about log access verification: Inquire about their process for checking log access compliance.
Look at
Examples of verification checks done against contractual agreements.
Good evidence
Regular checks are performed and documented to confirm log access aligns with the contract.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.19.
ISM-1573 requires contracts with service providers to document how the organisation can access all logs relating to its data and services. Annex A 5.19 requires processes and procedures to manage information security risks in supplier relationships, which typically includes defining security obligations, auditability, monitoring, and access to relevant security evidence. ISM-1573 is a specific supplier-contract requirement focused on log access, making it a concrete subset of the broader supplier relationship security management expected by Annex A 5.19.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.