ASD ISM 1961 Timely analysis of network device event logs
What it says
Event logs from non-internet-facing network devices are analysed in a timely manner to detect cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAnalyse logs from internal network devices quickly to detect security events.
This control is about regularly checking the logs from your organisation's network devices-like routers and switches-to spot any unusual or suspicious activity. If this isn't done, potential security threats could go unnoticed, leaving your business vulnerable to attacks or data breaches.
Free. Save your status, tasks and notes.
Why it matters
Failure to analyse network device logs promptly can allow undetected intrusions, leading to data breaches or loss of critical business assets.
How to implement
The IT team should regularly check logs from network devices to look for unusual patterns.
This involves setting a schedule to review logs at least weekly and using tools that can highlight unexpected activity.
Managers should ensure that the IT team is trained to recognise potential security events in network logs.
Arrange regular training sessions to keep the team updated on the latest threats and log analysis techniques.
The IT team should automate log analysis where possible using available tools.
Set up automated alerts that notify the team of specific key indicators of potential breaches, saving time and increasing effectiveness.
A dedicated staff member should be assigned responsibility for log monitoring.
Choose someone from the IT team to be the 'log champion'-this person will ensure daily reviews and be the first point of contact for any issues.
System owners should periodically meet with the IT team to review log findings.
Arrange quarterly meetings to discuss any trends or patterns identified, and adjust security measures as needed.
Keep it running
Review non-internet-facing network device event logs daily and alert on auth failures, config changes and unusual admin access; tune rules and escalate suspected incidents promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Evidence of log review schedules: Request the documented schedule of when log reviews occur.
Look at
Regular, frequent entries on this document.
Good evidence
A clear log showing dates and times of reviews, occurring at least weekly.
- Check 2 of 5What an auditor asks for
Ask for
To see the automated alert setup: Request a demonstration or screen captures showing automated alerts for log anomalies.
Look at
The kinds of alerts set up and their thresholds.
Good evidence
Well-configured alerts in line with organisational needs and risks.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request certificates or internal records showing IT log analysis training.
Look at
The dates and subjects covered.
Good evidence
Recent and relevant training attended by all key IT staff.
- Check 4 of 5What an auditor asks for
Ask for
Documentation of log review findings: Request reports or summaries from past log reviews.
Look at
Detailed analysis results and any actions taken.
Good evidence
Clear reports highlighting findings and remedial actions.
- Check 5 of 5What an auditor asks for
Ask for
Records of IT and management review meetings: Request minutes or notes from meetings between IT staff and management about log reviews.
Look at
Discussions about trends and security strategies.
Good evidence
Regular meetings with actionable conclusions documented.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML2.9, Cyber security events are analysed to identify incidents timely, which this control covers in full and more.
ASD Essential Eight: 11 mappings
This control is broader than E8-MF-ML2.9.
E8-MF-ML2.9 requires cyber security events to be analysed promptly to identify incidents. ISM-1961 is narrower, requiring timely analysis of event logs from non-internet-facing network devices to detect events, providing one channel of telemetry used to meet E8-MF-ML2.9. E8-MF-ML2.9 covers a wider set of event sources and emphasises incident identification rather than only log review for detection.
This control partially meets E8-AC-ML2.8.
ISM-1961 mandates timely analysis of event logs from non-internet-facing network devices to detect cyber security events. E8-AC-ML2.8 is broader because it requires timely analysis of cyber security events to identify incidents, without specifying log sources, device types, or network exposure. ISM-1961 is a more specific control that contributes to meeting the candidate by ensuring network-device-derived events are identified quickly.
This control partially overlaps E8-AC-ML3.4.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1961 requires timely analysis of event logs from non-internet-facing network devices, applying the same detection activity to a different infrastructure layer. They overlap on the analysis process and timeliness expectation, but differ in log sources (servers vs network devices).
This control partially overlaps E8-AH-ML2.14.
ISM-1961 requires timely analysis of event logs from non-internet-facing network devices to detect cyber security events. E8-AH-ML2.14 relates by requiring timely analysis of event logs to detect events, but it applies to internet-facing servers instead of internal network devices. The shared mechanism is log analysis for detection, while the exposure and system type differ (internet-facing servers vs internal network devices).
This control partially overlaps E8-AH-ML3.5.
E8-AH-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. ISM-1961 requires the same timely analysis practice for non-internet-facing network devices (e.g. switches/routers/firewalls). They overlap in log-review-for-detection, differing in telemetry types and ownership.
This control partially overlaps E8-MF-ML2.8.
E8-MF-ML2.8 requires organisations to analyse event logs from internet-facing servers in a timely manner to detect cyber security events. ISM-1961 similarly requires timely analysis of event logs, but it applies to non-internet-facing network devices rather than internet-facing servers. They align on the detection objective and timeliness expectation, but differ materially in asset scope (server vs network device; internet-facing vs internal).
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsPartially overlaps
This control partially overlaps E8-MF-ML3.4.
E8-MF-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1961 is similar in intent and timeliness but applies specifically to non-internet-facing network devices rather than servers. The controls overlap on internal log analysis for detection but differ in asset class and therefore coverage.
This control partially overlaps E8-RA-ML2.9.
E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1961 requires timely analysis of event logs from non-internet-facing network devices for the same detection purpose. They overlap in the expectation of prompt review for security event detection, but they apply to different asset classes.
This control partially overlaps E8-RA-ML2.10.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1961 requires timely analysis of event logs from non-internet-facing network devices to detect cyber security events, which feeds incident identification. The overlap is timely analysis, but ISM-1961 is limited to a particular log source category and focuses on event detection rather than the broader incident identification decision-making implied by E8-RA-ML2.10.
This control partially overlaps E8-RA-ML3.8.
E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1961 applies the same requirement to non-internet-facing network devices, which often interact with and generate complementary evidence for server-side investigations. They overlap on timely log analysis for event detection but cover different technology classes (servers vs network devices).
This control partially overlaps E8-RA-ML3.9.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1961 sets the same expectation for analysing event logs, but for non-internet-facing network devices. They share the monitoring-and-detection practice, but apply it to different classes of assets, so the controls only partially align.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.