ASD ISM 1989 Ensure event logs meet retention requirements
What it says
Event logs are retained as per minimum retention requirements for various classes of records as set out by the National Archives of Australia's Administrative Functions Disposal Authority Express (AFDA Express) Version 2 publication.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvent logs must be kept according to the retention rules set by the National Archives of Australia.
This control ensures that you keep important event logs-records of what happens in your systems-according to rules from the National Archives of Australia. This is crucial because without these records, you might not be able to investigate issues or respond to incidents, potentially leading to non-compliance with regulations or loss of trust from your customers.
Free. Save your status, tasks and notes.
Why it matters
If event logs are not retained to AFDA Express V2 minimum periods, investigations and audits may lack evidence, causing disposal breaches and compliance action.
How to implement
The IT team should establish a policy that specifies how long different types of event logs must be kept.
They can create a document that includes various retention periods as guided by the National Archives of Australia's rules.
Managers should ensure that the IT team and relevant staff are aware of and understand the log retention policy.
This can be done through regular training sessions that explain the importance of retaining logs and how it ties to organisational compliance.
The IT team should configure all relevant systems to automatically archive logs for the required retention period.
They can use system settings that allow logs to be saved securely and ensure they are not deleted prematurely.
System owners should perform regular checks to ensure that log retention settings are correctly applied.
They can do this by reviewing system configurations and retained logs to ensure compliance with the policy.
Managers should set a schedule for reviewing and updating the log retention policy to keep it in line with any changes in the rules or the organisation's needs.
This review can be done annually, with documented updates made as necessary.
Keep it running
Regularly confirm log retention periods match AFDA Express V2 record classes, and ensure archived logs are protected, searchable, and retrievable for audits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The event log retention policy document: Request a copy of the document that outlines how long different logs should be kept.
Look at
The specified retention periods and their alignment with the National Archives' guidance.
Good evidence
Detailed retention schedules that comply with national requirements.
- Check 2 of 5What an auditor asks for
Ask for
Recent training records on log retention: Request records of any training sessions held for staff about log retention policies.
Look at
Attendance records and training materials.
Good evidence
Would include recent and relevant training with a high participation rate.
- Check 3 of 5What an auditor asks for
Ask for
To see system configuration settings for log retention: Request a demonstration of how systems are set up to retain logs.
Look at
The configured retention settings and any automation involved.
Good evidence
Successfully applied settings that match the policy.
- Check 4 of 5What an auditor asks for
Ask for
Reports that track log retention compliance: Request any reports that show compliance with log retention policies.
Look at
The frequency and results of these checks.
Good evidence
Would show regular compliance checks with no significant issues.
- Check 5 of 5What an auditor asks for
Ask for
About the log policy review process: Request records or minutes from meetings where log retention policies were reviewed.
Look at
The outcomes and any action items from these meetings.
Good evidence
Shows recent and thorough reviews leading to updates or confirmations of the policy.
Mappings
Closest match in ISO/IEC 27001: A.5.33, Protection of records, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.33.
Annex A 5.33 requires records to be protected from loss and destruction, which includes having appropriate retention and preservation arrangements. ISM-1989 mandates that event logs are retained in line with National Archives of Australia retention requirements, which supports the availability and evidentiary value of this record type. ISM-1989 focuses on retention compliance for event logs and does not directly address unauthorised access/release or anti-tampering controls that Annex A 5.33 also requires.
This control partially overlaps A.8.15.
ISM-1989 requires event logs to be retained in line with minimum retention periods defined by the National Archives of Australia (AFDA Express). Annex A 8.15 requires that logs are produced, stored, protected and analysed, which necessarily includes keeping logs for a period of time. However, Annex A 8.15 does not specify Australian archival retention obligations, while ISM-1989 is focused specifically on records retention compliance rather than broader logging lifecycle controls.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-RA-ML2.6.
ISM-1989 requires event logs to be retained according to AFDA Express minimum retention requirements. E8-RA-ML2.6 requires privileged access events to be centrally logged, creating a specific class of security log records that then need to be retained. The overlap is that both concern security event logs as organisational records, but E8-RA-ML2.6 is about capturing/centralising privileged events whereas ISM-1989 is about how long any captured logs must be kept.
This control supports E8-AC-ML2.6.
ISM-1989 requires event logs to be retained in accordance with AFDA Express minimum retention requirements. E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion, which helps ensure logs can actually be retained for the required duration. ISM-1989 is about how long to keep logs, while E8-AC-ML2.6 is about protecting their integrity and availability to enable that retention.
This control supports E8-MF-ML2.7.
ISM-1989 requires retention of event logs in line with AFDA Express minimum retention requirements. E8-MF-ML2.7 requires event logs to be protected from unauthorised modification and deletion, which supports ensuring logs remain intact and available for the full mandated retention period. ISM-1989 defines the retention obligation, while E8-MF-ML2.7 provides a key safeguard to achieve it.
This control depends on E8-AH-ML2.13.
ISM-1989 requires event logs to be retained for minimum periods as set out in AFDA Express. E8-AH-ML2.13 requires protecting event logs from unauthorised modification and deletion, which directly supports meeting retention obligations by preventing premature loss or tampering. ISM-1989 sets the retention requirement, while E8-AH-ML2.13 addresses the security controls needed to keep logs trustworthy and available during that retention window.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.