ASD ISM 1984 Encrypt event logs in transit using ASD cryptography
What it says
Event logs sent to a centralised event logging facility are encrypted in transit using Australian Signals Directorate (ASD)-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvent logs must be encrypted with approved methods before being sent to a central logging system.
This control means making sure that as your organisation's event logs travel from various sources to a central system, they are encrypted using methods approved by the Australian Signals Directorate (ASD). This matters because if logs aren't encrypted, sensitive data could be intercepted and misused by cybercriminals.
Free. Save your status, tasks and notes.
Why it matters
If logs aren't encrypted in transit, sensitive information could be intercepted, leading to data breaches and reputational damage.
How to implement
IT team should ensure all event logs sent over the internet are encrypted.
They can do this by setting up secure connections using ASD-approved encryption methods like Transport Layer Security (TLS).
System administrators should regularly review and update the encryption protocols.
Check manuals and online resources from ASD for the latest guidelines on encryption standards.
Managers should schedule training sessions for staff on the importance of encrypting event logs.
Use simple training materials that explain what event logs are and why protecting them in transit is critical.
Procurement should verify that any new logging systems or tools support ASD-approved encryption.
Request confirmation from vendors that their products meet these standards before purchase.
The compliance officer should document the encryption process in a security policy.
This should include the encryption methods used, who is responsible for implementation, and how often it's reviewed.
Keep it running
Ensure encryption protocols are current and consistent across all systems. Regularly review ASD guidelines for any updates.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
the network security policy: Request the document that outlines how event log data is protected during transmission.
Look at
the encryption configuration settings: Verify that ASD-approved protocols like TLS are enabled.
Good evidence
A documented policy showing encryption standards, settings for TLS in network configurations, and personnel responsible for compliance.
- Check 2 of 4What an auditor asks for
Ask for
the list of log sources and destinations: This should show where logs originate and where they are sent within the organisation.
Look at
the log transport pathway documentation: Check it details encrypted pathways and methods in use.
Good evidence
Documentation showing log sources/destinations, encryption methods, and periodic reviews by the IT team.
- Check 3 of 4What an auditor asks for
Ask for
a training schedule: Ensure there are regular sessions on encryption practices.
Look at
the training materials and attendance records: Confirm they cover ASD-approved encryption methods.
Good evidence
Current training materials and participant lists showing regular training sessions.
- Check 4 of 4What an auditor asks for
Ask for
about the vendor selection process for logging tools: Inquire if ASD-approved encryption was a requirement.
Look at
purchase documents for new logging tools: These should specify encryption standards were a criteria.
Good evidence
Documentation of vendor assessments showing compliance with encryption standards at the time of purchase.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-1984 requires that event logs forwarded to a centralised event logging facility are encrypted in transit to protect them against interception and tampering during transmission. This supports ISO/IEC 27001:2022 Annex A 8.15 because Annex A 8.15 requires logs to be produced, stored and protected, and secure transport is a specific protection mechanism for the log-handling process when logs are transmitted to central storage/analysis. Annex A 8.15 remains broader because it also covers log creation, retention, access control, and analysis, whereas ISM-1984 is limited to transport encryption for forwarded logs.
This control partially meets A.8.24.
ISM-1984 requires a specific cryptographic use case: encrypt event log traffic while it is in transit to a centralised logging facility. This is a subset of ISO/IEC 27001:2022 Annex A 8.24, which requires the organisation to define and implement rules for cryptography and cryptographic key management across applicable scenarios, including data-in-transit protections. Annex A 8.24 is broader because it covers governance aspects such as algorithm choices, key lifecycle, roles and exceptions beyond the single scenario in ISM-1984.
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-01.1Encrypt event logs and restrict access to prevent tampering and deletionPartially overlaps
This control partially overlaps IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including encryption in transit and at rest; ISM-1984 requires event logs sent to central logging to be encrypted in transit with ASD-approved cryptography, the in-transit part.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.