ASD ISM 1586 Record all data imports and exports
What it says
Data transfer logs are used to record all data imports and exports from systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep logs to track every time data is transferred into or out of the system.
This control is about making sure you keep records every time data moves into or out of your system. It's important because without these logs, you might not notice if sensitive information is taken or something goes wrong during a transfer. Keeping good records helps protect your business from data breaches and ensures accountability.
Free. Save your status, tasks and notes.
Why it matters
Without data transfer logs for all imports/exports, unauthorised transfers can go undetected, delaying incident response and increasing the impact of data breaches.
How to implement
The IT team should implement a logging system: They should set up a tool or software that automatically records each data transfer.
This can be done by configuring the system to log details like the time of transfer, type of data, and who accessed it.
Managers should conduct regular reviews of the logs: They should set aside time once a month to review the data transfer logs.
This involves checking for any unusual or unexpected transfers and following up on them.
System owners need to establish a clear data transfer policy: They should define what constitutes an authorised data transfer and communicate this to all staff.
This can be done through a policy document and team meetings.
The IT team should ensure logs are securely stored: They should use secure digital storage to prevent tampering or loss of these logs.
This can involve encryption and access controls to ensure only authorised personnel can view them.
Senior management should allocate resources for log analysis tools: They should budget for tools that help summarise and analyse the log data to identify patterns or potential security issues.
This could be incorporated into the annual IT budget planning.
Keep it running
Record all imports/exports with timestamp, user, source/destination and data set; regularly review logs for anomalies and retain/protect logs to support investigations.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Data transfer logs for the past six months: Request to see records of data imports and exports recorded by the system.
Look at
The completeness and consistency of the logs, such as timestamps, data types, and responsible persons.
Good evidence
Would show comprehensive logs with no large gaps.
- Check 2 of 5What an auditor asks for
Ask for
The data transfer policy document: Request to see the policy that outlines how data transfers should be handled.
Look at
Clear definitions of authorised transfers and penalties for unauthorised activities.
Good evidence
Will have a dated policy with management approval.
- Check 3 of 5What an auditor asks for
Ask for
Meeting notes from monthly log reviews: Request notes or records from meetings where logs were reviewed.
Look at
Attendee lists and any actions taken in response to findings.
Good evidence
Will include documented follow-up on suspicious activities.
- Check 4 of 5What an auditor asks for
Ask for
Proof of log storage security measures: Request evidence of encryption and access controls on stored logs.
Look at
Descriptions of the security measures applied and tests of their effectiveness.
Good evidence
Will include technical details showing these measures are in place.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of log analysis tool usage: Request reports or summaries produced by log analysis tools.
Look at
How these tools are used to extract insights from the logs.
Good evidence
Will include recent reports with analysis of data transfer patterns and anomalies.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-1586 requires data transfer logs to record all data imports and exports, aligning with Annex A 8.15's broader requirement to produce, store, protect, and analyse logs of various activities. While Annex A 8.15 covers a wider range of events and includes protection and analysis expectations, ISM-1586 specifically focuses on logging data import/export activities.
This control partially overlaps A.5.33.
ISM-1586 mandates keeping logs to record all imports and exports of data, which ensures evidentiary records of transfers. Annex A 5.33 addresses the protection of records from loss, destruction, or unauthorised access, applicable to the integrity of data transfer logs as records. However, Annex A 5.33 does not require creating transfer logs, and ISM-1586 does not detail specific record protection measures.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.