ASD ISM 1855 Central logging of multifunction device use
What it says
Use of MFDs for printing, scanning and copying purposes, including the capture of shadow copies of documents, are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUses of multifunction devices are logged centrally for tracking purposes.
Central logging of multifunction device use means that everything you print, scan, or copy is tracked and recorded in one place. This is important because if there's a data breach or sensitive information is mishandled, you can trace back who did what, helping to prevent potential damage to your business's reputation and security.
Free. Save your status, tasks and notes.
Why it matters
Without central MFD logging (print/scan/copy and shadow copies), investigating document misuse is difficult, increasing risk of undetected data leakage.
How to implement
The IT team should set up a central logging system for multifunction devices (MFDs), ensuring every use of these devices is automatically recorded.
They need to configure MFDs to send activity logs to a secure server where all this information is collected and can be reviewed.
Managers should ensure that staff are aware of the logging process by organising a briefing session.
During this session, explain why logging is necessary for protecting sensitive information and how it helps in case of any security incidents.
Procurement officers should work with IT to choose multifunction devices that support central logging.
This involves reviewing specifications and confirming the devices can send log data directly to a central system before purchasing.
The IT team should regularly check the logging system to make sure it is working correctly.
This means verifying that data from all multifunction devices is updated in real time and no logs are missing or incomplete.
Security officers should have a process for reviewing logs in response to suspicious activity or security incidents.
This includes setting predefined criteria for what constitutes unusual activity and a plan for investigating these issues promptly.
Keep it running
Centrally collect MFD print/scan/copy and shadow-copy logs; review routinely and alert on spikes, after-hours use or repeated failures to spot misuse quickly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The logging configuration manual: Request the document that describes how the central logging system is set up for MFDs.
Look at
How logs are captured, stored, and reviewed.
Good evidence
Includes clear procedures detailing what is logged and the technology used to record and store this information.
- Check 2 of 5What an auditor asks for
Ask for
A sample activity log from the central logging system.
Look at
Entries detailing usage events from MFDs.
Good evidence
Log should include dates, times, user IDs, and actions taken (e.g., print, scan).
- Check 3 of 5What an auditor asks for
Ask for
A list of MFDs with logging enabled.
Look at
Confirmation that all devices in the organisation are sending logs to the central system. Good documentation will list device IDs, locations, and confirmation of integration with the logging system.
- Check 4 of 5What an auditor asks for
Ask for
To see evidence of periodic log reviews: Request records or emails showing that logs are regularly checked. Good evidence includes logs of review dates, who conducted them, and any actions taken based on findings.
- Check 5 of 5What an auditor asks for
Ask for
Any incident reports that involved MFD logs.
Look at
How effectively logs were used during investigations.
Good evidence
Will show logs being used to trace actions back to responsible users, outlining how this helped in resolving incidents.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-1855 requires organisations to centrally log multifunction device (MFD) use for printing, scanning and copying, including capturing shadow copies of documents. This is a specific instance of ISO/IEC 27001:2022 Annex A 8.15, which requires logs of relevant activities and events to be produced, stored, protected and analysed across information systems. Annex A 8.15 is broader (covers all relevant systems and includes protection/analysis expectations), while ISM-1855 focuses on one high-risk asset class (MFDs) and the specific event content to capture.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.