ASD ISM 1959 Ensure consistent formatting for event logs
What it says
To the extent possible, event logs are captured and stored in a consistent and structured format.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvent logs should be stored in a consistent format to ensure reliable data tracking.
This control means that any records of important activities, like logins or changes to a system, need to be in a clear and consistent format. This is important because if the records are a mess, it's tough to figure out what happened if something goes wrong, like a data breach or system failure.
Free. Save your status, tasks and notes.
Why it matters
Inconsistent log formats impede correlation and forensic analysis, slowing incident response and allowing breaches to go unnoticed.
How to implement
The IT team should design a standard template for event logs.
This template should clearly outline what kind of information needs to be included, such as the date, time, event description, and user details. Using a standard form helps everyone record information the same way each time.
Training staff responsible for entering log data is crucial.
Managers should ensure that these staff members know exactly how to fill out the logs correctly using the standard template. This can be achieved through a simple training session with examples of correctly filled logs.
System owners should ensure that the software systems they use are configured to produce logs in the agreed format automatically.
This might involve working with software vendors to adjust settings or select appropriate software features.
IT support should regularly review logs to ensure they remain consistent with the defined format.
They can use software tools to spot any discrepancies or manual checks at regular intervals.
Management should promote the importance of consistent logging in team meetings.
Highlighting the benefits, such as easier problem-solving and compliance with legal requirements, can encourage staff to maintain high standards of logging.
Keep it running
Standardise log schemas (e.g., JSON/CEF), validate fields and timestamps, and routinely sample logs to confirm consistent formatting across sources.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The event logging procedures document: Request the official procedure document that describes how logs should be formatted and maintained.
Look at
The presence of clear templates and instructions.
Good evidence
A well-defined document with clear formats for different types of events.
- Check 2 of 5What an auditor asks for
Ask for
Samples of recent event logs: Obtain logs from the last month for several critical systems and check their format.
Look at
Consistent entries that comply with the standard template. Good example: Each entry follows the same structure without missing key data fields.
- Check 3 of 5What an auditor asks for
Ask for
To see employee training records: Request proof of training sessions for staff responsible for log management.
Look at
Attendance logs or training completion certificates.
Good evidence
Documented sessions with staff sign-off and materials demonstrating the use of standard log formats.
- Check 4 of 5What an auditor asks for
Ask for
A report on log audits: Push for any internal audit results that include log format checks.
Look at
Findings and action points if any discrepancies were found. Good has clear evidence that variances were noted and corrected with follow-ups.
- Check 5 of 5What an auditor asks for
Ask for
To demonstrate system configuration settings: Request a demonstration of system log settings by IT staff.
Look at
How systems are set to export logs in the desired format. Good example: System settings visible and configured to create logs matching the standard format without manual intervention.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-1959 requires that, to the extent possible, event logs are captured and stored in a consistent and structured format. This relates directly to ISO/IEC 27001:2022 Annex A 8.15, which requires logs to be produced, stored, protected, and analysed. ISM-1959 is a specific quality/normalisation requirement within the broader logging lifecycle obligations in Annex A 8.15.
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-02.1Normalise, time-synchronise and enrich event logs for cross-system correlationPartially overlaps
This control partially overlaps IT.DET-02.1.
IT.DET-02.1 requires event logs to be normalised, time-synchronised and enriched to support correlation across systems and environments; ISM-1959 requires event logs to be captured and stored in a consistent and structured format where possible, covering the normalisation part.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.