ASD ISM 1963Central Logging of Events on Internet-Facing Devices
Official control statement
Security-relevant events for internet-facing network devices are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Important events on internet-connected network devices are logged in a central location for security.
What this means in practice
This control is about keeping a watchful eye on important activities that happen on your internet-connected devices, like routers and firewalls, by recording these activities in a central place. It's crucial because if you don't keep track of these events, you might miss early signs of a cyber attack, leading to data breaches or service disruptions.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Detective
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2024
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for networkingTopic
Network device event logging
Why it matters
Without central logging of internet-facing devices, early signs of attacks can be missed, leading to undetected breaches and significant disruptions.
Operational notes
Forward security events from all internet-facing network devices to a central log platform (e.g., SIEM), validate time sync, and alert on failed logins, config changes and blocked traffic.
Implementation tips
- IT team should configure network devices to send logs to a central logging system. They can do this by accessing the device's settings and entering the address of the central logging system, which can be a server or a service dedicated to storing and managing logs.
- The IT manager should ensure the central logging system is regularly monitored. This can be done by assigning specific staff to review logs daily or using alerts for unusual activities. Ensure the team knows how to identify and react to suspicious activity.
- System owners should work with the IT team to identify which events need logging. They should make a list of key events (like failed login attempts or configuration changes) and ensure these are tracked. Regular meetings can help fine-tune what events are logged.
- IT team should check the logging system's capacity and reliability. They need to make sure the system can store enough data and is protected against cyber threats. They can set up regular tests to ensure it's functioning well.
- The IT team should implement regular training sessions for staff who use the logging system. This training should focus on how to access the logs, interpret them, and escalate concerns if suspicious activities are noticed.
Audit / evidence tips
- AskThe central logging system's configuration records: Request documentation showing setup and settings for logging from internet-facing devicesLook atThe list of devices and events configured for loggingGoodShould show all critical devices listed and a comprehensive set of events being logged
- AskTo see recent log files or reports: Request a sample of recent logs captured by the central logging systemLook atLogs associated with important events like login attempts and configuration changesGoodShows regular, meaningful logs that match significant network activities
- AskIncident response procedures: Request the procedures for investigating logged eventsLook atClear instructions on how to deal with alerts from the logging systemGoodIncludes well-defined steps and assigned responsibilities for handling different types of events
- AskTraining records: Request documentation of staff training sessions on the logging systemLook atThe dates and attendees of the trainingGoodShows regular training sessions with relevant staff attending
- AskLog review records: Request records of when the logs were reviewed and by whomLook atConsistent review periods and notes on actions takenGoodIncludes detailed logs of reviews and appropriate follow-ups on any anomalies found
Cross-framework mappings
How ISM-1963 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 8.15 | ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged | |
| Annex A 8.20 | ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged | |
handshakeSupports(1)expand_less | ||
| Annex A 8.16 | ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged | |
E8
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| E8-AH-ML2.14 | E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Networking
See all Guidelines for networking controls, or browse the full ASD ISM library.