ASD ISM 1906 Timely analysis of internet-facing server logs
What it says
Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must quickly review logs from online servers to spot potential security threats.
This control is about regularly checking the records or logs from your online servers to quickly spot any security issues, like unauthorised access or attacks. If you don't do this, you might miss signs of a cyber threat, which could lead to loss of data, financial loss, or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without timely analysis of internet-facing server logs, intrusions may go unnoticed, delaying containment and increasing breach impact.
How to implement
The IT team should set up an automated system to collect logs from all internet-facing servers.
This can be done by using simple tools that gather these logs into one place so they can be easily reviewed.
Managers should schedule regular meetings to review these logs.
This involves a quick look at any unusual activity or anything that doesn't seem right compared to normal server activity.
System owners should train staff to recognise signs of irregular activity, such as unusual login times or access from unexpected locations.
This could include short, focused training sessions highlighting common signs of trouble.
The IT team should establish clear procedures for what to do when suspicious activity is detected.
This might involve contacting the manager immediately and initiating an internal review.
Managers should make sure there is someone assigned to review the logs every day.
This could be a rotating role among staff, ensuring that someone is always paying attention to server activity.
Keep it running
Configure alerts for suspicious internet-facing server log events and review flagged entries within 24 hours to detect and respond quickly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A report of recent server log reviews: Request documentation showing each time server logs were reviewed in the past month.
Look at
The dates and outcome of reviews.
Good evidence
Shows regular checks and any issues flagged for further review.
- Check 2 of 5What an auditor asks for
Ask for
To see the log review procedure document: Request the written procedures staff follow to review server logs.
Look at
Steps that identify unusual activity.
Good evidence
Includes a clear path for escalation if something odd is detected.
- Check 3 of 5What an auditor asks for
Ask for
Training records of staff: Request evidence of training sessions teaching staff to spot security concerns.
Look at
A list of employees who attended with dates.
Good evidence
Lists all relevant staff trained within the last year.
- Check 4 of 5What an auditor asks for
Ask for
Records of any suspicious activity detected: Request examples of past incidents logged and the actions taken.
Look at
The response times and measures implemented.
Good evidence
Shows prompt recognition and response to any unusual activities.
- Check 5 of 5What an auditor asks for
Ask for
Names of responsible individuals: Request a list of people who are accountable for log reviews. Look to see if there's a regular rotation or dedicated roles.
Good evidence
Ensures roles are clear and continuously filled.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.7, Event logs from internet-facing servers are analysed to detect cyber security events, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-1906 requires timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.15 is broader because it requires logs to be produced, stored, protected and analysed for activities, exceptions and faults across relevant systems. ISM-1906 aligns specifically to the 'analysed' aspect for a particular high-risk system class (internet-facing servers) and does not address log generation, retention, or protection requirements in Annex A 8.15.
ASD Essential Eight: 11 mappings
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsEquivalent
This control is equivalent to E8-AC-ML2.7.
ISM-1906 requires timely analysis of event logs from internet-facing servers to detect cyber security events. E8-AC-ML2.7 also requires internet-facing server event logs to be analysed in a timely manner for detection. Both controls are materially the same in scope (internet-facing servers), activity (analysis), and objective (event detection).
This control is equivalent to E8-AH-ML2.14.
E8-AH-ML2.14 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 states the same requirement for the same asset class (internet-facing servers) and the same objective (detect cyber security events) with comparable specificity. Implementing ISM-1906 would largely satisfy E8-AH-ML2.14 and vice versa.
This control is equivalent to E8-MF-ML2.8.
ISM-1906 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. E8-MF-ML2.8 states the same requirement for the same log source (internet-facing servers) and the same purpose (timely detection). The scope and intent align closely, with only framework context differing.
This control is equivalent to E8-RA-ML2.9.
E8-RA-ML2.9 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 states the same requirement for timely analysis of internet-facing server logs to detect cyber security events. The scope and intent align closely, with no meaningful difference in depth or coverage.
This control is broader than E8-AC-ML2.8.
E8-AC-ML2.8 requires prompt analysis of cyber security events so incidents are identified quickly. ISM-1906 requires timely analysis of event logs from internet-facing servers to detect cyber security events. This is one important subset of the overall event-analysis obligation described by E8-AC-ML2.8.
This control is broader than E8-MF-ML2.9.
E8-MF-ML2.9 requires organisations to analyse cyber security events in a timely manner to identify incidents. ISM-1906 narrows this to timely analysis of internet-facing server logs to detect cyber security events, which is one input into the broader event-to-incident determination in E8-MF-ML2.9. E8-MF-ML2.9 is not confined to internet-facing servers and includes the incident identification outcome.
This control partially overlaps E8-AC-ML3.4.
E8-AC-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 is closely related but applies the same log analysis expectation to internet-facing servers instead. They overlap on the practice of timely log analysis for detection, but differ materially in asset scope (internal/non-internet-facing vs internet-facing).
This control partially overlaps E8-AH-ML3.5.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-1906 similarly requires timely analysis of event logs, but it is scoped to internet-facing servers. They overlap on the core detection practice (timely log analysis), while differing in asset class and typical log sources.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsPartially overlaps
This control partially overlaps E8-MF-ML3.4.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1906 mandates the same type of timely analysis but for internet-facing servers. They overlap on the practice of prompt log review for detection, but their scopes are distinct based on server exposure.
This control partially overlaps E8-RA-ML2.10.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1906 operationalises this for one high-risk log source by requiring timely analysis of event logs from internet-facing servers to detect cyber security events. The overlap is the timeliness and analytical review to surface incidents, but ISM-1906 is limited to a specific asset class while E8-RA-ML2.10 applies across the organisation's event sources.
This control partially overlaps E8-RA-ML3.8.
E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1906 is similar in method (timely log analysis for detection) but applies to internet-facing servers rather than internal servers. They overlap on the monitoring practice but differ materially in the system exposure context and therefore the specific logging scope.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.