ASD ISM 1988 Ensure event logs are retained for 12 months
What it says
Event logs are retained in a searchable manner for at least 12 months.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep event logs searchable and accessible for at least 12 months to help in audits or investigations.
Keeping digital event logs for at least 12 months means that any records of activities on your computer systems remain accessible for a year, helping you to look into any suspicious behaviour or satisfy regulatory checks. If you don't keep these logs, you might miss critical clues needed to investigate a problem or prove compliance.
Free. Save your status, tasks and notes.
Why it matters
Without 12-month log retention, critical incident traces can be lost, hampering investigations and regulatory compliance efforts.
How to implement
The IT team should ensure that the system settings are configured to retain event logs for 12 months.
They can do this by adjusting the log settings in server management tools to store records for the required time period.
Managers should coordinate with the IT team to review and verify the retention settings regularly.
This can be done by adding a monthly check on their calendar to compare current retention settings against policy requirements.
System administrators should back up event logs securely.
They can schedule automatic back-ups to a secure location, like an on-site server or a cloud service, ensuring backup copies are also kept for 12 months.
Business owners should ensure there is a documented policy for log retention.
They should collaborate with IT to draft a clear policy document that outlines the retention period and reasons for it.
Compliance officers should conduct quarterly reviews to verify log retention practices.
They can hold meetings with IT staff to discuss and inspect logs, ensuring logs from at least 12 months ago remain accessible.
Keep it running
Configure systems to retain searchable event logs for 12 months; periodically test log search and verify retention settings to support investigations and audits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The log retention policy document: Request the policy that details how long logs are kept and where they are stored. Look to ensure it specifies a minimum of 12 months retention.
Good evidence
Includes a clear policy with details consistent with actual retention practices.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of log retrieval from 12 months ago: Request to see logs from a year ago being accessed or retrieved.
Look at
Proof that logs are accessible without issues.
Good evidence
Shows the log data being retrieved swiftly and accurately without errors.
- Check 3 of 5What an auditor asks for
Ask for
IT maintenance records: Request records of any evaluations or changes to log retention settings.
Look at
Entries about retention checks or settings updates.
Good evidence
Includes recent records showing checks were done and issues addressed.
- Check 4 of 5What an auditor asks for
Ask for
Backup records of event logs: Request documentation showing regular backups of event logs.
Look at
Backup frequency and storage location details.
Good evidence
Includes clear, regular logs being backed up to a safe location.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of quarterly review meetings: Request notes or minutes from meetings about log reviews.
Look at
Evidence of discussion on retention practices.
Good evidence
Shows consistent meetings with clear actions or decisions recorded.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-1988 requires event logs to be retained in a searchable manner for at least 12 months. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes (but does not mandate) retention duration and searchability. ISM-1988 is therefore a specific retention/searchability requirement within the broader logging lifecycle expectations of Annex A 8.15.
This control supports A.5.28.
ISM-1988 requires event logs to be retained in a searchable manner for at least 12 months. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for collecting and preserving evidence related to information security events, which often relies on the existence and accessibility of historical logs. ISM-1988 strengthens Annex A 5.28 by ensuring logs are available and searchable to support evidence preservation, but it does not define broader evidence-handling procedures (e.g. chain of custody).
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingPartially overlaps
This control partially overlaps IT.DET-01.3.
IT.DET-01.3 requires a centralised event log storage capability that protects logs from unauthorised access or modification; ISM-1988 requires event logs to be retained in a searchable manner for at least 12 months, adding a retention requirement for stored logs.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.