ASD ISM 1986 Timely analysis of critical server event logs
What it says
Event logs from critical servers are analysed in a timely manner to detect cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvent logs from important servers are quickly reviewed to find security issues.
This control is about keeping a close eye on event logs from your important servers to quickly spot any signs of trouble. If you don't regularly check these logs, you might miss early signs of a cyber attack, which could lead to data loss or business disruption.
Free. Save your status, tasks and notes.
Why it matters
If critical server event logs are not analysed promptly, intrusions and misuse may go undetected, leading to data compromise and service outages.
How to implement
System owners should appoint a person or team responsible for log reviewing.
This could be an IT professional or an external service provider who is familiar with your server operations. Make sure they know what normal log entries look like so they can spot anything unusual.
The IT team should establish a schedule for checking event logs, ideally daily or weekly.
Use clear, straightforward steps to go through the logs to identify any signs that may indicate a security incident, like unexpected changes or access attempts.
Business leaders should set aside time for regular training on how to interpret event logs.
This can involve quick workshops or online courses to make sure everyone involved understands what to look for and how to respond to potential issues.
IT teams should create a standard procedure for when unusual activity is detected in logs.
This should detail steps on how to report and who to notify, ensuring quick escalation and resolution to minimise potential damage.
Keep it running
Analyse critical server event logs daily (within 24 hours) via SIEM; investigate anomalies and escalate suspected incidents immediately.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The log review schedule document: Request to see the documented schedule for regular event log checks.
Look at
Whether it clearly outlines the frequency and the person or team responsible.
Good evidence
Is the existence of a readable schedule with specific dates, times, and names.
- Check 2 of 5What an auditor asks for
Ask for
Evidence of alert handling: Request to see examples of alerts that were acted upon from log reviews.
Look at
Whether there are follow-up actions documented, showing that anomalies were addressed.
Good evidence
Is a folder of incidents with resolution notes and dates.
- Check 3 of 5What an auditor asks for
Ask for
The list of approved log review tools: Request documentation that lists the software used for log reviews.
Look at
Whether the tools are currently operational and set to notify users of abnormal activities.
Good evidence
Is a list of tools with their features, setup guides, and an assessment of their effectiveness.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request any records or logs of training sessions done for staff involved in log monitoring.
Look at
Evidence of who attended, the content covered, and dates of training.
Good evidence
Includes detailed attendance records and a summary of topics covered.
- Check 5 of 5What an auditor asks for
Ask for
Escalation procedures: Request the procedure document for responding to anomalies found in logs.
Look at
Clear steps on what to do and whom to inform if something unusual is found.
Good evidence
Contains a flowchart or step-by-step instructions with contact names and numbers.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.8, Cyber security events are analysed in a timely manner, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader as it covers log production, storage, protection, and analysis across the organisation. ISM-1986 focuses on log analysis for critical servers.
ASD Essential Eight: 15 mappings
This control is broader than E8-AC-ML2.8.
E8-AC-ML2.8 requires timely analysis of cyber security events to identify cyber security incidents across the environment. ISM-1986 narrows this to timely analysis of event logs from critical servers specifically to detect cyber security events. ISM-1986 is therefore one concrete subset of the broader event-analysis expectation in E8-AC-ML2.8.
This control is broader than E8-AH-ML2.15.
E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISM-1986 is narrower, focusing on analysis of critical server event logs. E8-AH-ML2.15 is broader as it applies across all sources and decides if an event is an incident.
This control is broader than E8-MF-ML2.9.
E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents. ISM-1986 narrows this to timely analysis of event logs from critical servers to detect cyber security events, which is one source feeding the broader event-analysis function in E8-MF-ML2.9. E8-MF-ML2.9 is not limited to critical server logs and includes wider event sources and the specific goal of incident identification.
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsPartially overlaps
This control partially overlaps E8-AC-ML2.7.
ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events. E8-AC-ML2.7 aligns with ISM-1986 where critical servers are internet-facing, requiring timely analysis of their event logs to detect events. The key difference is scope: ISM-1986 is based on criticality (including internal critical servers), while E8-AC-ML2.7 is limited to internet-facing servers.
This control partially overlaps E8-AC-ML3.4.
E8-AC-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include both internet-facing and non-internet-facing systems depending on how 'critical' is defined. They align on timely analysis for detection, but differ in scoping criteria (exposure-based vs criticality-based).
This control partially overlaps E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include internet-facing servers but also includes critical internal servers. The overlap exists where an internet-facing server is also classified as critical; otherwise, the scoping criteria differ (exposure vs criticality).
This control partially overlaps E8-AH-ML3.4.
E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1986 also requires timely analysis of server logs, but it is scoped to 'critical servers' regardless of whether they are internet-facing or non-internet-facing. They overlap where critical servers are also non-internet-facing, but each control covers scenarios the other does not (non-critical non-internet-facing servers vs internet-facing critical servers).
This control partially overlaps E8-AH-ML3.5.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which is the same function applied to a higher criticality asset group. The overlap is the analysis timeliness and detection objective; the difference is asset scope.
This control partially overlaps E8-MF-ML2.8.
ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events. E8-MF-ML2.8 mandates timely analysis of logs from internet-facing servers, including some critical servers. ISM-1986 is driven by server criticality, while E8-MF-ML2.8 is driven by exposure (internet-facing).
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsPartially overlaps
This control partially overlaps E8-MF-ML3.4.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include both internet-facing and non-internet-facing systems depending on classification. They overlap where critical servers are also non-internet-facing, but each control has unique scoping criteria (exposure vs criticality).
This control partially overlaps E8-RA-ML2.9.
E8-RA-ML2.9 requires prompt analysis of internet-facing server logs to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers. The controls align on the action (timely analysis) and objective (detect events) but differ on the scoping dimension (internet exposure vs criticality).
This control partially overlaps E8-RA-ML2.10.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1986 specifies timely analysis of event logs from critical servers to detect cyber security events, directly contributing to incident identification. The overlap is the expectation of prompt log/event review, but ISM-1986 is constrained to critical servers whereas E8-RA-ML2.10 is broader across event sources and incident identification processes.
This control partially overlaps E8-RA-ML3.8.
E8-RA-ML3.8 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include both internet-facing and non-internet-facing systems depending on the environment. The overlap is the same activity (timely server log analysis), but ISM-1986 is scoped by criticality rather than network exposure.
This control partially overlaps E8-RA-ML3.9.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1986 applies the same core requirement (timely log analysis for event detection) but for critical servers rather than workstations. They overlap on the detection activity and timeliness expectation, but differ in asset scope (workstations vs critical servers) and therefore do not fully satisfy each other.
This control depends on E8-AH-ML2.12.
E8-AH-ML2.12 requires centralised logging of command line process creation events, which are commonly critical for detecting attacker tradecraft on servers. ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events. E8-AH-ML2.12 supports ISM-1986 by ensuring an important subset of critical server logs is collected centrally, but it does not address the analysis cadence or the broader set of critical server log sources.
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; ISM-1986 requires timely analysis of critical server event logs to detect cyber security events, applying detection to those servers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.