ASD ISM 1963 Central logging of events on internet-facing devices
What it says
Security-relevant events for internet-facing network devices are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImportant events on internet-connected network devices are logged in a central location for security.
This control is about keeping a watchful eye on important activities that happen on your internet-connected devices, like routers and firewalls, by recording these activities in a central place. It's crucial because if you don't keep track of these events, you might miss early signs of a cyber attack, leading to data breaches or service disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of internet-facing devices, early signs of attacks can be missed, leading to undetected breaches and significant disruptions.
How to implement
IT team should configure network devices to send logs to a central logging system.
They can do this by accessing the device's settings and entering the address of the central logging system, which can be a server or a service dedicated to storing and managing logs.
The IT manager should ensure the central logging system is regularly monitored.
This can be done by assigning specific staff to review logs daily or using alerts for unusual activities. Ensure the team knows how to identify and react to suspicious activity.
System owners should work with the IT team to identify which events need logging.
They should make a list of key events (like failed login attempts or configuration changes) and ensure these are tracked. Regular meetings can help fine-tune what events are logged.
IT team should check the logging system's capacity and reliability.
They need to make sure the system can store enough data and is protected against cyber threats. They can set up regular tests to ensure it's functioning well.
The IT team should implement regular training sessions for staff who use the logging system.
This training should focus on how to access the logs, interpret them, and escalate concerns if suspicious activities are noticed.
Keep it running
Forward security events from all internet-facing network devices to a central log platform (e.g., SIEM), validate time sync, and alert on failed logins, config changes and blocked traffic.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central logging system's configuration records: Request documentation showing setup and settings for logging from internet-facing devices.
Look at
The list of devices and events configured for logging.
Good evidence
Should show all critical devices listed and a comprehensive set of events being logged.
- Check 2 of 5What an auditor asks for
Ask for
To see recent log files or reports: Request a sample of recent logs captured by the central logging system.
Look at
Logs associated with important events like login attempts and configuration changes.
Good evidence
Shows regular, meaningful logs that match significant network activities.
- Check 3 of 5What an auditor asks for
Ask for
Incident response procedures: Request the procedures for investigating logged events.
Look at
Clear instructions on how to deal with alerts from the logging system.
Good evidence
Includes well-defined steps and assigned responsibilities for handling different types of events.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request documentation of staff training sessions on the logging system.
Look at
The dates and attendees of the training.
Good evidence
Shows regular training sessions with relevant staff attending.
- Check 5 of 5What an auditor asks for
Ask for
Log review records: Request records of when the logs were reviewed and by whom.
Look at
Consistent review periods and notes on actions taken.
Good evidence
Includes detailed logs of reviews and appropriate follow-ups on any anomalies found.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of activities and relevant events across systems more broadly, which includes centralising logs as a common implementation. ISM-1963 is a specific application of Annex A 8.15 limited to internet-facing network devices and central logging (not the full lifecycle of log protection and analysis).
This control partially meets A.8.20.
ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, and central logging of device security events is a concrete mechanism that supports secure management and operational control. Annex A 8.20 is broader and covers many security measures beyond logging, whereas ISM-1963 is specifically about centralising security event logs for internet-facing devices.
This control supports A.8.16.
ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged. Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour, which is materially enabled by centralised logging from edge and internet-facing devices to detect anomalies and investigate incidents. Annex A 8.16 is broader (monitoring and response), while ISM-1963 is a foundational telemetry collection requirement focused on device logs.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1963 requires central logging of security-relevant events for internet-facing network devices, which complements detection across the internet perimeter. They share the goal of enabling detection via logs, but differ in both activity (analysis vs centralisation) and asset type (servers vs network devices).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.