ASD ISM 1660 Central logging of application events
What it says
Allowed and blocked application control events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll application events, whether allowed or blocked, must be recorded centrally.
This control is about making sure that every time an application on your computer system does something important-like allowing or blocking an action-it's reported to one central location. If you don't do this, you risk missing signs that something is going wrong, which means you might not catch a problem or an attack before it causes serious harm.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of allowed and blocked application control events, suspicious executions may be missed, delaying detection and response to malware or misuse.
How to implement
The IT team should set up a central logging system to collect all application events.
This involves choosing software that can automatically gather event logs from applications and sending them to a central server where they can be reviewed.
Application administrators need to make sure their applications are configured to log every action.
This means adjusting settings in each application to record events like access attempts and errors, whether they're allowed or blocked.
Management should designate a person or team to regularly review the logs.
They should check the logs for unusual activity, such as repeated failed login attempts, and investigate any suspicious behaviour promptly.
The IT team should establish a routine maintenance schedule for the central logging system to ensure it's running smoothly.
This includes checking storage capacity, ensuring data is being received correctly, and performing updates to software as needed.
System owners must communicate with IT to ensure that new applications are integrated into the central logging system.
This requires establishing a clear process whereby IT is informed of any new applications so they can set up necessary logging configurations.
Keep it running
Forward allowed/blocked application control events to a central log store, verify coverage across hosts, and alert on repeated blocks or unexpected allows.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central logging policy document: Request the policy document that outlines how application events are logged centrally.
Look at
Whether the policy specifies the types of events to be logged and the method for logging them.
Good evidence
Will include a detailed process that encompasses setup, review, and maintenance of logs.
- Check 2 of 5What an auditor asks for
Ask for
To see a log review schedule: Request any documentation or schedules that show regular log reviews.
Look at
Evidence of reviews, such as dates and reviewer names, indicating these checks are happening consistently.
Good evidence
Is a well-documented schedule showing routine log analysis over time.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of the logging system: Have the IT team demonstrate how logs are collected and accessed.
Look at
How easy it is to identify an application's logged events.
Good evidence
Involves a clear, understandable process for accessing and analysing logs.
- Check 4 of 5What an auditor asks for
Ask for
To see recent log review findings: Request reports from recent log reviews.
Look at
The issues identified and any actions taken.
Good evidence
Includes specific examples of identified issues, actions taken, and confirmation of resolution or follow-up.
- Check 5 of 5What an auditor asks for
Ask for
Records of training about the logging system: Request records showing staff have been trained to understand and manage the logging process.
Look at
Evidence of staff attendance at training sessions.
Good evidence
Is a dated list of participants and session content, indicating ongoing staff education.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.5, Allowed and blocked application control events are centrally logged, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AC-ML2.5.
ISM-1660 requires that both allowed and blocked application control events are centrally logged. E8-AC-ML2.5 states the same requirement for central logging of allowed and blocked application control events. The scope and intent align closely, with no material differences in what must be logged or where it must be collected.
This control supports E8-AC-ML2.6.
ISM-1660 requires central logging of allowed and blocked application control events so they are available for monitoring and investigation. E8-AC-ML2.6 strengthens this by requiring event logs be protected from unauthorised modification and deletion, helping preserve the integrity of the centrally collected application control events. ISM-1660 focuses on central collection, while E8-AC-ML2.6 focuses on tamper protection of the logs once generated/collected.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.