ASD ISM 1910 Log network API calls for data protection
What it says
Network API calls that facilitate modification of data, or access to data not authorised for release into the public domain, and are accessible over the internet, are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure API calls over the internet that change or access sensitive data are logged centrally.
It's crucial to keep track of when your computer systems make requests for or change important information online. If you don't, you might miss signs of an attack or misuse that could lead to data exposure or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without centrally logging internet-exposed API calls that modify or access sensitive data, breaches may go undetected, enabling theft and reputational harm.
How to implement
IT team should set up central logging: Ensure that all changes to sensitive information made via online requests (network API calls) are recorded in a single place.
Use available tools to automatically gather these logs from the systems involved.
System admins should define what counts as sensitive data: Clearly identify which types of data are sensitive and need to be logged when accessed or changed.
Create a list with examples such as customer information or financial records.
Managers should oversee a regular logging review: Schedule routine checks to ensure logs are properly recorded and any anomalies are caught early.
Assign someone to be responsible for these regular reviews and establish a simple procedure for them.
Procurement should acquire suitable logging tools: Purchase or subscribe to tools that can reliably gather and store logs from all relevant systems and are easy for your IT team to use.
Consider tools recommended by the Australian Cyber Security Centre (ACSC).
Training coordinators should educate staff: Provide training sessions for relevant staff about the importance of logging and how to handle logs securely.
Include practical exercises that show how logs help spot security issues.
Keep it running
Centrally capture logs for internet-exposed APIs (create/update/delete and sensitive reads), sync time, and routinely alert on anomalous access patterns.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central logging configuration: Request documentation that describes the logging setup for API calls.
Look at
The types of logs being captured and the data flow to ensure all sensitive actions are logged.
Good evidence
Shows comprehensive coverage of sensitive actions.
- Check 2 of 5What an auditor asks for
Ask for
Recent log reviews: Request records showing when recent log reviews were conducted and by whom.
Look at
The dates and actions taken as a result of reviews.
Good evidence
Includes regular review dates and documented follow-ups on anomalies.
- Check 3 of 5What an auditor asks for
Ask for
To see data classification lists: Request lists or policies that identify sensitive data requiring logging.
Look at
Whether the listed data types match the profile of your business or organisation.
Good evidence
Aligns with your risk assessment and covers all critical data.
- Check 4 of 5What an auditor asks for
Ask for
Staff training records: Request evidence of training sessions for staff involved in logging.
Look at
Attendance records and training content.
Good evidence
Includes completed and up-to-date training that covers logging practices.
- Check 5 of 5What an auditor asks for
Ask for
A demonstration of logging tools: Request a walk-through of how your logging tools work and where logs are located.
Look at
The ease of use and effectiveness in capturing necessary log data.
Good evidence
Shows a tool that effectively centralises logs and is easy for staff to manage.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.7, Event logs from internet-facing servers are analysed to detect cyber security events, which this control supports.
ASD Essential Eight: 1 mapping
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsSupports
This control supports E8-AC-ML2.7.
ISM-1910 requires centrally logging internet-accessible network API calls that modify data or access non-public data. E8-AC-ML2.7 depends on that type of logging being available because it requires event logs from internet-facing servers to be analysed to detect cybersecurity events. Centrally logged API call records are a key input to that analysis. E8-AC-ML2.7 focuses on timely analysis/detection, whereas ISM-1910 focuses on ensuring the relevant API activity is captured centrally in the first place.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.