ASD ISM 1976 Central logging of security events on macOS
What it says
Security-relevant events for Apple macOS operating systems are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure security events on macOS systems are logged centrally for monitoring.
This control means that important security-related activities on your Apple computers (macOS) should be reported to a central location so they can be closely watched. This is vital because if these activities are not tracked, you might miss signs of a cyber attack, which could lead to data loss or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of macOS security events, threats may go unnoticed, leading to potential breaches and data theft.
How to implement
The IT team should set up a logging system: They need to find software that can collect security-related information from all macOS computers.
This can be done by installing a central logging tool that gathers logs and sends them to a secure location for monitoring.
The IT manager should ensure compliance: They need to establish policies that require all macOS devices in the organisation to participate in central logging.
This involves communicating the importance of logging to all users and ensuring they follow the policy.
The system administrator should configure macOS devices: They need to set up each device to ensure it sends the correct logs to the central server.
This could involve changing settings in macOS to enable and direct logs as needed.
The security team should routinely check logs: They need to regularly review the logs collected in the central server to spot any unusual activity.
This can be done using tools that highlight suspicious behaviour or patterns.
The procurement team should select appropriate software: They need to purchase or subscribe to a reliable logging and monitoring solution that suits the organisation's needs.
This involves researching options, getting quotes, and discussing needs with the IT team.
Keep it running
Regularly confirm macOS security logs are forwarded to the central log server/SIEM; investigate gaps, failed forwarding, and time sync issues promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central logging policy document: Request to see the policy that states all macOS devices must log security events centrally.
Look at
The document's date and distribution list.
Good evidence
A recent policy document shared with all relevant staff.
- Check 2 of 5What an auditor asks for
Ask for
A sample of recent logs: Request logs from the central logging system for a specified recent period.
Look at
Logs that clearly show security events from macOS devices.
Good evidence
Logs that include timestamps, device IDs, and event details.
- Check 3 of 5What an auditor asks for
Ask for
The list of monitoring tools used: Request a list of software and tools used for central logging and monitoring.
Look at
The software specifications and deployment status.
Good evidence
A comprehensive list with information on deployment and current usage.
- Check 4 of 5What an auditor asks for
Ask for
Access review reports: Request reports showing reviews of the central logging access permissions.
Look at
Who has access to the logs and recent audit outcomes.
Good evidence
A report showing limited access to authorised personnel only.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of security training: Request records or schedules of training provided to staff about the importance of central logging.
Look at
Attendance records and training content.
Good evidence
Training logs showing recent sessions attended by IT and security teams.
Mappings
Closest match in ISO/IEC 27001: A.8.16, Monitoring networks and systems for anomalous behaviour, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.16.
ISM-1976 requires security-relevant events for Apple macOS operating systems to be centrally logged. ISO/IEC 27001:2022 Annex A 8.16 requires organisations to monitor networks, systems and applications for anomalous behaviour and take appropriate actions, which typically relies on logging and telemetry across the environment. ISM-1976 is a specific logging implementation for one OS, whereas Annex A 8.16 is broader and outcome-focused on detection and response.
This control depends on A.5.28.
ISM-1976 requires security-relevant events on macOS to be centrally logged, improving availability and consistency of audit trails. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identifying, collecting, acquiring and preserving evidence related to information security events, for which centralised logs are a key evidence source. ISM-1976 supports evidence preservation by ensuring macOS logs are captured centrally, but Annex A 5.28 extends to procedural chain-of-custody and broader evidence types beyond logs.
ASD Essential Eight: 7 mappings
This control partially overlaps E8-AC-ML2.5.
ISM-1976 requires security-relevant events on Apple macOS systems to be centrally logged for monitoring. E8-AC-ML2.5 relates by requiring central logging of a specific subset of security events (allowed/blocked application control decisions) that could occur on macOS endpoints. ISM-1976 is broader and OS-specific (macOS) while E8-AC-ML2.5 is control-domain specific (application control) and not limited to macOS.
This control partially overlaps E8-AC-ML2.6.
ISM-1976 requires central logging of macOS security events. E8-AC-ML2.6 relates by requiring event logs to be protected from unauthorised modification and deletion, which is an integrity safeguard commonly applied to centrally collected logs. ISM-1976 focuses on ensuring central collection on macOS, while E8-AC-ML2.6 focuses on tamper protection and integrity controls regardless of OS.
This control partially overlaps E8-MF-ML2.6.
ISM-1976 requires central logging of security-relevant events on macOS systems. E8-MF-ML2.6 relates by requiring successful and unsuccessful MFA events to be centrally logged, which may include authentication events generated by macOS-integrated identity services. ISM-1976 is broader and OS-scoped, whereas E8-MF-ML2.6 is narrower and event-category specific (MFA) regardless of operating system.
This control partially overlaps E8-RA-ML2.6.
ISM-1976 requires central logging of security-relevant events on macOS endpoints. E8-RA-ML2.6 specifically requires privileged access events to be centrally logged, which are typically part of the macOS security-relevant event set (e.g., elevation and administrative access). ISM-1976 is broader across event types on macOS, while E8-RA-ML2.6 is more focused on a particular access-related event class.
- E8-RA-ML2.7Centrally log privileged user account and security group management eventsPartially overlaps
This control partially overlaps E8-RA-ML2.7.
ISM-1976 requires central logging of security-relevant events on macOS systems. E8-RA-ML2.7 covers central logging of privileged account and group management events, which are a subset of security-relevant events that may occur on macOS (local accounts/groups or directory-integrated administration). ISM-1976 is broader across all macOS security events, while E8-RA-ML2.7 is narrower and focused on identity administration changes.
This control supports E8-MF-ML3.5.
ISM-1976 requires macOS security event logs to be centrally collected so they are available for monitoring. E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events, which depends on having workstation logs accessible and aggregated. ISM-1976 contributes the collection/centralisation foundation, while E8-MF-ML3.5 adds the operational detection/analysis requirement not covered by ISM-1976.
This control depends on E8-AH-ML2.12.
E8-AH-ML2.12 requires centralised logging of command line process creation to detect suspicious execution. ISM-1976 requires central logging of security-relevant events for macOS, which may include process execution telemetry depending on audit configuration and tooling. ISM-1976 supports coverage of E8-AH-ML2.12 on macOS, but is broader and not explicitly limited to command line process creation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.