ASD ISM 1907 Timely analysis of non-internet-server logs
What it says
Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishExamine logs from servers not facing the internet promptly to find security issues.
This control is about making sure that logs from servers that aren't directly connected to the internet are looked at quickly. It's important because these logs can reveal hidden security threats or unusual activity, and if not checked regularly, problems could go unnoticed until they cause significant damage.
Free. Save your status, tasks and notes.
Why it matters
If non-internet-facing server logs aren't analysed promptly, internal compromise and lateral movement may go unnoticed, delaying detection and response.
How to implement
The IT team should schedule regular reviews of server logs.
Set up a calendar reminder to check these logs at least weekly for any unusual activities or patterns that don't look right.
System administrators need to use a consistent method for analysing logs.
They should use an application or tool that helps summarise log data so that they can spot issues quickly without sifting through pages of details.
The office manager should ensure that someone is specifically tasked with log analysis.
Assign this responsibility clearly in a staff meeting and include it in the job description of an IT staff member.
Managers should encourage staff training on log interpretation.
Organise a workshop or training session about common security threats and how they might show up in logs. This should be done in-house or with a local provider.
Business owners should allocate resources for maintaining and securing log data.
Budget for tools that store and archive logs securely so that past records can be accessed for audits or investigations.
Keep it running
Analyse non-internet-facing server logs daily (or per risk), use alerting for suspicious events, and document triage and escalation timelines.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
To see the log review schedule: Request the calendar or system that tracks when log reviews are supposed to happen.
Look at
The frequency of the reviews and the responsible person.
Good evidence
Shows consistent, planned log review times with named individuals.
- Check 2 of 5What an auditor asks for
Ask for
A sample log report: Request a recent example of an analysed log report.
Look at
How issues were identified and addressed. Good practice is clear indication of anomalies, and notes on any actions taken.
- Check 3 of 5What an auditor asks for
Ask for
To see the team member responsibility list: Request a document or section in someone's job description that contains log review tasks.
Look at
Specific mention of log analysis duties.
Good evidence
Lists roles and their specific responsibilities.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of log analysis training: Request training records or certificates.
Look at
The number of attendees and the course content. Good practice is having detailed logs or certificates of completed training sessions on log analysis.
- Check 5 of 5What an auditor asks for
Ask for
To see the log archive solution: Request documentation of how logs are stored and protected.
Look at
Information about data retention and security measures.
Good evidence
Is a documentation that outlines secure storage and access policies.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML3.4, Event logs from non-internet-facing servers are analysed, which asks for the same thing.
ASD Essential Eight: 13 mappings
This control is equivalent to E8-AC-ML3.4.
E8-AC-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement with the same asset scope (non-internet-facing servers) and the same detection objective (timely analysis to detect events). Implementing ISM-1907 would largely satisfy E8-AC-ML3.4 and vice versa.
This control is equivalent to E8-AH-ML3.4.
E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement for non-internet-facing server event logs and the same outcome (timely detection of cyber security events). The scope, asset type (non-internet-facing servers) and action (timely analysis) align closely between E8-AH-ML3.4 and ISM-1907.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsEquivalent
This control is equivalent to E8-MF-ML3.4.
E8-MF-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement for the same asset scope (non-internet-facing servers) and the same intent (timely detection of security events). There are no material differences in scope or depth between E8-MF-ML3.4 and ISM-1907.
This control is equivalent to E8-RA-ML3.8.
E8-RA-ML3.8 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement for the same asset class (non-internet-facing servers) and the same outcome (detection of cyber security events via timely log analysis). The scope and intent align closely, making this a direct one-to-one mapping.
This control is broader than E8-AC-ML2.8.
E8-AC-ML2.8 requires organisations to analyse cyber security events in a timely manner to determine whether they are incidents. ISM-1907 focuses that requirement on event logs from non-internet-facing servers, requiring those logs to be analysed promptly to detect events. This is a scoped implementation area that sits within the wider, whole-of-environment intent of E8-AC-ML2.8.
This control is broader than E8-MF-ML2.9.
E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents. ISM-1907 focuses specifically on timely analysis of event logs from non-internet-facing servers to detect cyber security events, which contributes to the broader event analysis required by E8-MF-ML2.9. The candidate is a subset (one log source category), whereas E8-MF-ML2.9 applies to cybersecurity events across the environment and drives incident identification.
This control partially overlaps E8-AH-ML2.14.
E8-AH-ML2.14 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 requires timely analysis of event logs from non-internet-facing servers for the same detection purpose, using the same operational concept (review/analysis for event detection). They align on the activity and intent, but differ on asset scope (internet-facing vs internal servers), so neither fully satisfies the other.
This control partially overlaps E8-AH-ML3.5.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-1907 requires timely analysis of event logs from non-internet-facing servers, using the detection-oriented activity but for a different system category. The overlap is in the requirement to review logs promptly; the difference is the device scope.
This control partially overlaps E8-MF-ML2.8.
ISM-1907 requires timely analysis of logs from non-internet-facing servers to detect cyber security events. E8-MF-ML2.8 addresses timely analysis too, but for internet-facing servers rather than non-internet-facing servers. They overlap in the logging/monitoring activity and detection objective, but differ materially in the asset scope being monitored.
This control partially overlaps E8-RA-ML2.9.
E8-RA-ML2.9 requires event logs from internet-facing servers to be analysed promptly to detect cyber security events. ISM-1907 applies the same timely log analysis requirement but for non-internet-facing servers, aligning on the analysis activity and purpose. They differ mainly by asset exposure scope (internet-facing vs internal).
This control partially overlaps E8-RA-ML2.10.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1907 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events, supporting the same detection-to-incident pathway. The overlap is the timeliness and analysis expectation, but ISM-1907 is scoped to a specific server category while E8-RA-ML2.10 is organisation-wide and oriented to incident identification.
This control partially overlaps E8-RA-ML3.9.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1907 requires timely analysis of logs from non-internet-facing servers for the same detection purpose. The overlap is the log-analysis process and objective, while the key difference is the technology scope (workstations versus non-internet-facing servers).
This control depends on E8-AH-ML2.12.
E8-AH-ML2.12 requires command line process creation events to be centrally logged, creating a reliable log source for server monitoring. ISM-1907 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. E8-AH-ML2.12 supports ISM-1907 by ensuring a key category of server telemetry is centralised and available for that analysis, but ISM-1907 is about analysis timeliness and applies to many log types beyond command line events.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.