ASD ISM 1889 Central logging of command line events
What it says
Command line process creation events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTrack all command line actions by keeping a central log of every new process initiated via the command shell.
Central logging of command line actions is about keeping a record of every new task a computer starts through typing commands. This matters because without these logs, unauthorised activities might go unnoticed, putting your important information at risk.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of command line process creation, attackers can run commands without trace, delaying detection, investigation and containment.
How to implement
IT team should set up a logging system: Use software that records every command line action on all networked computers.
Ensure the software is compatible with your systems and regularly check it's capturing all relevant data.
System administrators should monitor logs: Have designated staff regularly review the logs for any unusual or unauthorised activities.
Set up alerts for certain types of actions that should be flagged for further investigation.
Managers should ensure staff are trained: Organise basic training for staff to recognise the importance of command line security.
Explain what actions on their part might be recorded and why it's crucial for protecting business assets.
IT team should back up logs regularly: Implement a secure and automated process for backing up log data to prevent loss in case of system failures.
Ensure backups are stored securely and can be easily restored if needed.
Management should conduct periodic reviews: Schedule regular meetings to review the effectiveness of logging practices.
Discuss any incidents detected through logs and update procedures to address any uncovered vulnerabilities.
Keep it running
Forward command line process creation logs to a central SIEM and alert on suspicious parent/child process chains, unusual shells and admin tools.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The logging software specifications: Request documentation showing what software is used for logging command line activities.
Look at
The features list and supported systems.
Good evidence
Shows software that matches your system's needs and captures comprehensive activity logs.
- Check 2 of 5What an auditor asks for
Ask for
A sample log report: Request a copy of a typical command line activity report from the last month.
Look at
The type and detail of activities captured.
Good evidence
Includes clear, readable logs that track who made changes and when.
- Check 3 of 5What an auditor asks for
Ask for
The training records: Request evidence of training sessions provided to staff about command line security.
Look at
Names, dates, and topics covered.
Good evidence
Includes dated records showing active training programs tailored to staff roles.
- Check 4 of 5What an auditor asks for
Ask for
Backup procedures: Request the documented procedures for backing up log files.
Look at
Frequency, methods, and who is responsible.
Good evidence
Includes clear procedures with accountability for maintaining data integrity and confidentiality.
- Check 5 of 5What an auditor asks for
Ask for
Incident review meetings: Request minutes or reports from meetings discussing log reviews and incidents.
Look at
Attendance, discussions on specific incidents, and actions decided.
Good evidence
Shows regular evaluations and updates to security practices based on logs.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.12, Command line process creation logging is centralised, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-1889 requires a specific class of security-relevant logging: centrally recording command line process creation events. Annex A 8.15 requires organisations to produce, store, protect and analyse logs for a broad range of activities and events. ISM-1889 is therefore a concrete, narrower implementation that would contribute to meeting Annex A 8.15 but does not cover its full logging lifecycle or breadth of event types.
This control supports A.8.16.
ISM-1889 requires central logging of command line process creation events to improve visibility of potentially suspicious execution behaviour. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents. Centralised command line process creation logs from ISM-1889 materially strengthen detection and investigation under Annex A 8.16, but Annex A 8.16 also covers broader telemetry and response actions beyond this single log source.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-AH-ML2.12.
E8-AH-ML2.12 requires organisations to centrally log command line process creation events for monitoring and detection. ISM-1889 states the same requirement: that command line process creation events are centrally logged. The two controls align in scope (command line process creation) and the centralisation outcome, with no material difference in intent or depth.
- E8-AH-ML2.11Centrally log PowerShell module, script block, and transcription eventsPartially overlaps
This control partially overlaps E8-AH-ML2.11.
ISM-1889 requires central logging of command line process creation events to provide visibility of command shell activity. E8-AH-ML2.11 also requires central logging, but is specific to PowerShell module logging, script block logging and transcription events. They overlap where PowerShell activity occurs via command execution, however E8-AH-ML2.11 captures richer PowerShell content while ISM-1889 is focused on process creation for command line activity more generally.
This control supports E8-AC-ML3.5.
ISM-1889 requires that command line process creation events are centrally logged. E8-AC-ML3.5 requires timely analysis of workstation event logs to detect security events. ISM-1889 provides a critical subset of workstation-relevant telemetry (process creation from the command line) that can be analysed to meet E8-AC-ML3.5, but E8-AC-ML3.5 expects analysis across broader workstation logging sources.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.