ASD ISM 1983 Log events sent to centralised facility quickly
What it says
Event logs sent to a centralised event logging facility are sent as soon as possible after they occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all event logs are sent to a central logging facility as soon as possible after occurring.
This control means that when something important happens in your computer systems, a record of it should be sent to a central place as soon as possible. It matters because if there's a security issue, being able to see these records quickly can help stop or fix the problem before it becomes a big deal.
Free. Save your status, tasks and notes.
Why it matters
Delayed logs can mean security incidents go unnoticed, leading to data breaches or system downtime.
How to implement
IT team should ensure that logging settings are configured: Adjust settings so that all important activity logs from computers and systems are sent immediately to a central server.
Use easy-to-understand instructions from your logging software vendor.
System owners should routinely verify log transmissions: Regularly check that logs are being sent to the central facility without delays.
This can be done by randomly viewing log timestamps and cross-check with the central server.
Managers should discuss with IT about log management policies: Ensure there are clear rules about what needs to be logged and sent to the central server, and how quickly it should happen.
Have clear communication channels for any adjustments needed.
IT team should set up automated alerts for failures: Use simple automatic notifications to know instantly if logs are not being sent as expected.
These can be configured in the logging system preferences.
Compliance officers to conduct regular reviews: Every few months, go over the log data transfer process to ensure it aligns with company policy and any legal requirements.
Update procedures if necessary to fix any gaps found.
Keep it running
Regularly verify that logging systems are functioning and alarms trigger as expected to swiftly address any failures.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
log transmission reports: Request recent records showing when logs were sent to the central facility.
Look at
the timestamps to ensure logs are sent promptly.
Good evidence
is showing logs are sent within minutes of creation.
- Check 2 of 5What an auditor asks for
Ask for
to see the logging configuration settings: Check if the systems are set up to send logs automatically to the central server.
Look at
settings that indicate immediate or very frequent log transfers.
Good evidence
is a screenshot or document confirming this.
- Check 3 of 5What an auditor asks for
Ask for
any incidents of delayed logging: Request incident logs that record any delays in sending logs.
Look at
investigation notes on causes and fixes.
Good evidence
is documented resolution steps with timeframes.
- Check 4 of 5What an auditor asks for
Ask for
to see notifications of log transmission failures: Request evidence of setup for alerts when logs fail to send.
Look at
logs showing alerts were properly triggered.
Good evidence
shows consistent alerting without gaps.
- Check 5 of 5What an auditor asks for
Ask for
a demonstration of the logging process: Request a live demonstration of a recent log event and its path to the central system.
Look at
the demonstration of how quickly it is processed.
Good evidence
shows minimal delay.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-1983 requires event logs to be sent to a centralised event logging facility as soon as possible after they occur. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant activities and events, covering the end-to-end logging lifecycle. Centralised, timely forwarding in ISM-1983 is one implementation approach that supports Annex A 8.15's broader requirements, but Annex A 8.15 also includes protection and analysis not addressed by ISM-1983.
ASD Essential Eight: 6 mappings
This control partially overlaps E8-AC-ML2.5.
ISM-1983 requires event logs to be sent to a centralised logging facility as soon as possible after they occur. E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged, and ISM-1983 supports this by ensuring those events are rapidly forwarded for monitoring and correlation. E8-AC-ML2.5 is narrower (application control events) and does not set the same explicit timeliness requirement as ISM-1983.
- E8-AH-ML2.11Centrally log PowerShell module, script block, and transcription eventsPartially overlaps
This control partially overlaps E8-AH-ML2.11.
ISM-1983 requires event logs to be forwarded to a centralised logging facility as soon as possible after they occur. E8-AH-ML2.11 mandates that specific PowerShell telemetry (module, script block and transcription events) is centrally logged, which relies on timely forwarding/centralisation to be useful for detection and investigation. E8-AH-ML2.11 is narrower in scope (PowerShell-specific) and does not itself specify the timing requirement that ISM-1983 emphasises.
This control partially overlaps E8-RA-ML2.6.
ISM-1983 requires event logs to be sent to a centralised event logging facility as soon as possible after they occur. E8-RA-ML2.6 specifically requires privileged access events to be centrally logged, and timely centralisation per ISM-1983 strengthens the completeness and integrity of those privileged event records for detection and forensics. E8-RA-ML2.6 is narrower (privileged access events only) and does not explicitly require the 'as soon as possible' forwarding expectation in ISM-1983.
This control supports E8-AH-ML2.12.
E8-AH-ML2.12 requires centralised logging of command line process creation events, which is most valuable when logs arrive centrally quickly enough for monitoring and response. ISM-1983 requires that event logs are sent to the centralised logging facility as soon as possible after they occur. E8-AH-ML2.12 depends on ISM-1983-like timeliness to make centralisation effective for detection, though E8-AH-ML2.12 does not itself specify transmission latency.
This control supports E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1983 requires event logs to be forwarded to a centralised logging facility as soon as possible after they occur, which improves timeliness and reliability of subsequent analysis. Where the organisation relies on a central platform (e.g. SIEM) to perform the analysis required by E8-AH-ML2.14, rapid log forwarding is a practical prerequisite.
This control supports E8-MF-ML3.5.
E8-MF-ML3.5 requires workstation event logs to be analysed in a timely manner to detect cyber security events. ISM-1983 requires event logs to be sent to a centralised logging facility as soon as possible after they occur, which supports near-real-time visibility needed for timely analysis. Where the organisation relies on centralised monitoring/SIEM for analysis, E8-MF-ML3.5 is effectively dependent on ISM-1983 to avoid delay between event occurrence and analyst review.
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes to be forwarded to central log storage; ISM-1983 requires event logs sent to a centralised logging facility to be sent as soon as possible after they occur, adding a timeliness requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.