ASD ISM 1987 Timely analysis of security event logs
What it says
Event logs from security products are analysed in a timely manner to detect cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSecurity event logs are reviewed promptly to identify cyber threats.
This control is about keeping a close eye on security events by regularly checking the logs of security systems. It's important because if you don't promptly review these logs, you might miss early signs of a cyber threat like hacking or data breaches. Being timely helps you respond quickly, stopping potential security issues before they become major problems.
Free. Save your status, tasks and notes.
Why it matters
Delayed analysis of security logs allows cyber threats to escalate, increasing the risk of significant data breaches or system compromises.
How to implement
System owners should regularly allocate time to review security event logs.
Perhaps spend an hour each week going through recent logs to look for any unusual activity or repeated errors. This helps catch small issues before they grow.
The IT team should set up automated alerts for the logs to flag any critical or unusual events.
Use simple notifications to email or text staff when something doesn't look right, so they can take a closer look as needed.
Managers should schedule monthly meetings with IT to discuss trends in logged events.
Review whether specific types of alerts are increasing, and decide if any follow-up actions are required.
HR should ensure training sessions are available for staff on how to identify basic security threats.
This helps everyone understand what could be suspicious, making it easier to report issues promptly.
Have a regular spot check process: IT and security teams could fast-track the review of random selections of logs.
This encourages a continuous state of alertness and ensures nothing slips through the cracks.
Keep it running
Configure SIEM and security tools to alert on suspicious events in near real time, and perform daily log review with escalation and triage procedures.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A sample security log review record: Request to see a recent report of the logs that were reviewed.
Look at
The details to ensure they cover recent events and identify any potential threats.
Good evidence
The report should clearly list all logs reviewed, highlight any incidents, and indicate follow-up actions.
- Check 2 of 5What an auditor asks for
Look at
Clear settings for alert criteria and notification methods.
Good evidence
Documented alerts should have clear thresholds and defined recipients for each alert level.
- Check 3 of 5What an auditor asks for
Ask for
Minutes from the monthly meeting discussions: Check notes from these meetings to see how log trends were discussed and decisions made.
Good evidence
Meeting minutes should show proactive discussion on trends and specify any actions or changes implemented.
- Check 4 of 5What an auditor asks for
Look at
Who attended and what was covered in training sessions about recognising threats.
Good evidence
Attendance logs paired with training materials show comprehensive coverage of relevant topics and good staff participation.
- Check 5 of 5What an auditor asks for
Ask for
Examples of spot check reviews: Check how spot checks are conducted and their outcomes documented.
Good evidence
Records should demonstrate regular spot check operations, with detail on findings and subsequent security actions.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.8, Cyber security events are analysed in a timely manner, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, covering the full logging lifecycle and associated safeguards. ISM-1987 aligns to the 'analysed' component (with an emphasis on timeliness for detection) but does not cover log generation, protection and retention to the same breadth as Annex A 8.15.
This control partially overlaps A.8.16.
ISM-1987 requires timely analysis of event logs from security products to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which commonly uses log analysis alongside other telemetry. The overlap is in detection and evaluation activities, but Annex A 8.16 is broader than log review (e.g. behavioural and network monitoring) while ISM-1987 is specifically log-analysis timeliness.
ASD Essential Eight: 11 mappings
This control is broader than E8-AC-ML2.8.
E8-AC-ML2.8 requires timely analysis of cyber security events so that incidents can be identified. ISM-1987 specifically requires timely analysis of event logs produced by security products (e.g. EDR/SIEM/security appliances) to detect events. The candidate is a subset channel of telemetry, while E8-AC-ML2.8 is broader about event analysis regardless of source.
This control is broader than E8-AC-ML3.5.
E8-AC-ML3.5 requires workstation event logs to be analysed promptly to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products, which can include endpoint/workstation security tooling (e.g., EDR/AV) but is not limited to workstations. The overlap is the shared requirement for timely log analysis for event detection, while ISM-1987 is broader by source type (security products generally) and E8-AC-ML3.5 is specific to workstation logs.
This control is broader than E8-MF-ML2.8.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. E8-MF-ML2.8 mirrors this intent but narrows scope to event logs from internet-facing servers. As a result, E8-MF-ML2.8 is a specific subset of the broader monitoring and detection expectation in ISM-1987.
This control is broader than E8-MF-ML2.9.
E8-MF-ML2.9 requires timely analysis of cyber security events to identify incidents. ISM-1987 specifically requires timely analysis of logs from security products (e.g. EDR/SIEM/IDS) to detect cyber security events, which directly supports the event analysis activity in E8-MF-ML2.9. The candidate is limited to a particular class of logging source, while E8-MF-ML2.9 is broader and includes deciding when events constitute incidents.
This control is broader than E8-RA-ML3.8.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. E8-RA-ML3.8 requires the same timely analysis outcome but restricts the log source to non-internet-facing servers. This makes E8-RA-ML3.8 a subset implementation within the wider log-analysis expectation of ISM-1987.
This control is broader than E8-RA-ML3.9.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. E8-RA-ML3.9 applies the same requirement specifically to workstation event logs. E8-RA-ML3.9 therefore covers only one log source category, while ISM-1987 expects timely analysis across relevant security-product logs more generally.
This control partially overlaps E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products (e.g. EDR, SIEM, IDS), which often ingest or correlate server logs to detect events. The controls align on timely log analysis for detection, but ISM-1987 focuses on security tooling logs rather than server-originated logs specifically.
This control partially overlaps E8-AH-ML3.5.
E8-AH-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products, which often ingest workstation telemetry. They overlap in prompt analysis requirement but differ in log focus.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsPartially overlaps
This control partially overlaps E8-MF-ML3.4.
E8-MF-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products (e.g. EDR, SIEM, firewalls), which can provide detections relevant to internal server activity. They overlap on timely analysis for detection but differ in log source: server operating/application logs versus security product logs.
This control partially overlaps E8-RA-ML2.9.
E8-RA-ML2.9 requires prompt analysis of internet-facing server logs to detect cyber security events. ISM-1987 requires timely analysis of logs from security products, which may include server telemetry. The overlap is the expectation of timely review to detect events.
This control supports E8-RA-ML2.10.
E8-RA-ML2.10 requires timely analysis of cyber security events to determine whether they constitute incidents. ISM-1987 focuses specifically on timely analysis of event logs from security products to detect cyber security events, which feeds the event stream that E8-RA-ML2.10 then triages into incidents. ISM-1987 is log-source specific and detection-oriented, while E8-RA-ML2.10 is broader in covering event-to-incident analysis across sources.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.