ASD ISM 1964 Central logging for network device events
What it says
Security-relevant events for non-internet-facing network devices are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLogs activities from internal network devices to keep track of security-related events.
Central logging means keeping all the records of what your network devices are doing in one place, like having a detailed diary. This matters because if something goes wrong, like an unauthorised person trying to sneak into your network, you'll have the information needed to catch it and solve the problem quickly.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of non-internet-facing network device events, unauthorised access or misuse may go undetected, delaying response and investigation.
How to implement
IT team: Set up a central logging system.
This means choosing software or a tool that can collect and store logs from all your network devices in one place. Make sure it fits your budget and business size.
System owner: Define which network events are important to log.
Work with your IT team to decide what types of activities need monitoring, such as access attempts, changes to device settings, and unusual network traffic.
IT team: Configure your network devices.
Ensure that all devices on your network, like routers and switches, are set to send their logs to the central logging system. Check the instructions for each device to find out how to do this.
Manager: Schedule regular reviews of your logs.
Set up a timetable for when logs should be checked, such as weekly or monthly, to look for any suspicious activity. This could help catch issues early.
HR: Train staff on security awareness.
Educate your team about the importance of logs and how secure network practices help protect the business. This ensures everyone knows what to watch out for and report.
Keep it running
Configure non-internet-facing network devices to forward security-relevant events to a central log system; verify coverage, time sync, retention and alerting on anomalies.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central logging system logs: Request to see the logs collected in the central system over the past six months.
Look at
The consistency and completeness of the logs from various devices.
Good evidence
Is complete logs with no data gaps, showing consistent data collection from all relevant devices.
- Check 2 of 5What an auditor asks for
Ask for
The list of network events being logged: Request the document or configuration file that details what types of events the network devices are set to log.
Look at
Key events like access attempts and configuration changes.
Good evidence
Shows a comprehensive list covering various security-relevant events.
- Check 3 of 5What an auditor asks for
Ask for
The procedure for log reviews: Request the written process or schedule used for checking the logs.
Look at
How often and by whom the logs are reviewed.
Good evidence
Includes a clear timetable and designated personnel responsible for reviews.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of response to logged events: Request records of any actions taken due to findings in the logs.
Look at
Incident reports or emails addressing issues found during log reviews.
Good evidence
Includes documented cases with actions taken and outcomes.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records: Request documentation of security training sessions for staff.
Look at
Training dates and topics covered, with attendance records.
Good evidence
Includes recent training on the importance of network logs and general security awareness.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-1964 requires security-relevant events for non-internet-facing network devices to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 (Logging of Activities and Events) is broader, requiring logs of relevant events to be produced, stored, protected and analysed across systems. ISM-1964 is a specific application of Annex A 8.15 focused on centralising logs for a particular asset class (internal network devices) rather than covering protection and analysis requirements.
This control partially meets A.8.20.
ISM-1964 requires central logging of security-relevant events from non-internet-facing network devices. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled more generally. ISM-1964 is a specific network-device security measure (central logging) that sits within the broader expectations of Annex A 8.20.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.