ASD ISM 1979 Central logging for security events on servers
What it says
Security-relevant events for server applications on non-internet-facing servers are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRecord important server activities in a central system to monitor non-internet-connected servers.
This control ensures that all important activities happening on your servers that don't connect to the internet are recorded in one central place. This is crucial because if something goes wrong, you'll have a record to find out what happened. Missing these records could leave you blind to a hack, data theft, or software failure, putting your business at risk.
Free. Save your status, tasks and notes.
Why it matters
Without central logging, security events on non-internet-facing server applications may be missed, delaying detection and investigation of compromise or data leakage.
How to implement
The IT team should set up a system that collects logs from all non-internet-facing servers.
They can do this by configuring each server to send its logs (which are like digital activity diaries) to one computer that collects them all. This ensures all important actions are recorded in one spot.
Managers should ensure the logs are checked regularly.
They can do this by setting up a weekly schedule where a trained staff member reviews the logs for any unusual activity. This keeps them alert to potential issues early.
System owners should decide which activities need logging by working with the IT team to identify what's most critical, like login attempts or software changes.
This ensures that no important events are missed.
The IT team should put in place alerts for unusual activities.
They can set up the logging system to automatically flag strange patterns, like many failed login attempts, so they can react quickly if something's wrong.
Business leaders should allocate resources for training staff on how to understand and use logs.
This could be a short course explaining what logs are and how to spot unusual activity, empowering everyone to contribute to security.
Keep it running
Forward server application security event logs to a central log server/SIEM; verify coverage and time sync. Review and alert weekly for failed logins, privilege changes and errors.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The central logging setup documentation: Request the documents or settings that show how server logs are collected centrally.
Look at
How each server is set up to send its logs to the main collection system.
Good evidence
Includes screenshots or printouts of this setup clearly showing active configurations.
- Check 2 of 5What an auditor asks for
Ask for
The log review schedule and records: Request evidence of regular log review.
Look at
The review schedule and notes or reports from these reviews.
Good evidence
Has dated logs of reviews, findings, and any actions taken.
- Check 3 of 5What an auditor asks for
Ask for
A list of activities identified for logging: Check if there is a documented list of what events need to be logged from each server. Good evidence includes a document showing these specific activities and reasons for selection.
- Check 4 of 5What an auditor asks for
Ask for
To see alert configurations: Request evidence of alerts set up for unusual activities in the logs. Examine screenshots or settings showing these automated alerts.
Good evidence
Shows active alerts for key events like failed login attempts.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records: Request evidence of any training sessions held on server log monitoring. Check for attendance records, training materials, and feedback.
Good evidence
Includes a completed training register with dates and participant names.
Mappings
Closest match in ISO/IEC 27001: A.8.16, Monitoring networks and systems for anomalous behaviour, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.8.16.
Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour with actions taken to evaluate possible incidents. ISM-1979 relates by requiring central logging of security-relevant events for server applications on non-internet-facing servers, which supports detection and investigation of anomalies. Annex A 8.16 is broader because it covers active monitoring and incident evaluation across all environments, not just central log collection for a specific server class.
This control partially meets A.8.15.
ISM-1979 requires security-relevant events for server applications on non-internet-facing servers to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 requires logs of relevant events to be produced, stored, protected and analysed across the organisation, which includes server application events but extends beyond them. ISM-1979 is a specific implementation focus (central logging for non-internet-facing servers) within the broader logging lifecycle required by Annex A 8.15.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-AC-ML2.5.
ISM-1979 requires security-relevant events for server applications on non-internet-facing servers to be centrally logged. E8-AC-ML2.5 relates by requiring central logging of application control allow/block events, which are a subset of security-relevant server events that may occur on servers. However, E8-AC-ML2.5 is limited to application control telemetry, while ISM-1979 is broader across server application security events on non-internet-facing servers.
This control supports E8-AH-ML3.4.
E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1979 requires security-relevant events for server applications on non-internet-facing servers to be centrally logged, which improves completeness and accessibility of log data for analysis. In practice, achieving timely, consistent analysis under E8-AH-ML3.4 is often dependent on the central logging capability mandated by ISM-1979, although E8-AH-ML3.4 can be performed with local logs at reduced effectiveness.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsSupports
This control supports E8-MF-ML3.4.
ISM-1979 requires central logging of security-relevant events for server applications on non-internet-facing servers. E8-MF-ML3.4 requires timely analysis of non-internet-facing server event logs to detect cyber security events, which is strengthened by having logs forwarded to a central platform as required by ISM-1979. The candidate emphasises monitoring/analysis outcomes, while ISM-1979 emphasises centralised log capture.
This control supports E8-RA-ML3.8.
ISM-1979 requires centrally logging security-relevant events for server applications on non-internet-facing servers. E8-RA-ML3.8 relates by requiring timely analysis of non-internet-facing server event logs to detect cyber security events, which depends on having accessible and aggregated logs from those servers. ISM-1979 does not require analysis timeliness, while E8-RA-ML3.8 does.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.