ASD ISM 2051 Ensure event logs for cyber security event detection
What it says
Software generates sufficient event logs to support the detection of cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSoftware should create logs to help detect security incidents.
Software should automatically keep a record of important activities and events. This is crucial because if something goes wrong, like a cyberattack or data breach, these logs can help us understand what happened and how to fix it.
Free. Save your status, tasks and notes.
Why it matters
If software does not generate sufficient event logs, cyber security events may not be detected or investigated, increasing dwell time and impact on organisational assets.
How to implement
The IT team should configure software applications to log key events.
They can do this by setting up the software's logging options during installation or through the application's settings menu. This ensures that important actions, like user logins and data changes, are recorded.
System owners should routinely check that logging is enabled on all essential systems.
They can do this by verifying log files are being updated regularly. This ensures ongoing coverage without gaps that might miss significant incidents.
Managers should create a policy on log retention and review.
Work with the IT team to decide how long logs should be kept and how often they should be reviewed for suspicious activity. This helps ensure that logs provide a useful history if needed for an investigation.
The IT team should implement automated alerts for unusual events in logs.
Utilise built-in features of the software or additional security tools to notify relevant staff of potential issues. This helps catch problems early by allowing quick responses to anomalies.
HR should train employees on recognising and reporting potential cyber incidents.
Include information on the importance of event logs and how their activities might be logged for security purposes. These trainings raise awareness and ensure everyone knows their role in maintaining security.
Keep it running
Configure software to generate security-relevant logs (auth, privilege, admin actions, errors) with timestamps and user IDs, and regularly verify coverage and fields needed for detection.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The software's logging configuration documentation: Request a report or screenshot showing the current logging settings for key applications. Look to see if logging is enabled for critical actions like logins and data changes.
Good evidence
Is a detailed configuration showing specific events that are set to be logged.
- Check 2 of 5What an auditor asks for
Ask for
A recent log review summary: Request any report or notes from when staff last reviewed event logs.
Look at
Which logs were reviewed and what findings were recorded.
Good evidence
Includes a summary with dates, systems reviewed, and any follow-up actions taken.
- Check 3 of 5What an auditor asks for
Ask for
A copy of the log retention policy: Request the document outlining how long logs are kept. Look to ensure it aligns with your organisation's needs and any legal requirements.
Good evidence
Shows a policy with clear timelines and responsibilities for log management.
- Check 4 of 5What an auditor asks for
Ask for
Incident response records that relied on logs: Request examples where logs were used to address or investigate a security incident.
Look at
Entries that link to the logs and detail how they were used.
Good evidence
Demonstrates how logs have informed decisions or investigations.
- Check 5 of 5What an auditor asks for
Ask for
To see the staff training materials on security logging: Request session outlines or presentation slides covering event logging.
Look at
Information on why logs matter and how they are used in security monitoring.
Good evidence
Includes recent training records showing active engagement with all staff.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
ISM-2051 requires that software generates sufficient event logs to support detection of cyber security events. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected, and analysed, covering more than just the generation sufficiency for detection as in ISM-2051.
This control partially overlaps A.5.28.
ISM-2051 requires event logs sufficient for cyber event detection. ISO/IEC 27001:2022 Annex A 5.28 involves procedures for identifying, collecting, and preserving evidence of security events, overlapping where logs are used as evidence but not focused on log generation.
This control supports A.8.16.
ISM-2051 mandates generating sufficient event logs for cybersecurity detection. ISO/IEC 27001:2022 Annex A 8.16 involves monitoring for anomalies and potential incidents, which necessitates relevant logs. ISM-2051 supports this by ensuring the necessary log data exists.
ASD Essential Eight: 6 mappings
This control supports E8-AC-ML3.4.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-2051 requires sufficient event log generation, which is a prerequisite for meaningful log analysis.
This control supports E8-AC-ML3.5.
E8-AC-ML3.5 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-2051 requires software to generate sufficient event logs to support detection, which is a prerequisite for meaningful and effective workstation log analysis. Without the log generation coverage mandated by ISM-2051, E8-AC-ML3.5 cannot be reliably achieved because there may be insufficient workstation telemetry to analyse.
This control supports E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-2051 requires software to generate sufficient event logs to enable detection of cyber security events, which is a prerequisite for meaningful analysis. Without ISM-2051-style log sufficiency on internet-facing servers, E8-AH-ML2.14 cannot be effectively achieved.
This control supports E8-AH-ML3.5.
E8-AH-ML3.5 requires organisations to analyse workstation event logs in a timely manner. ISM-2051 requires event log generation sufficient for detection, which is necessary for effective workstation log analysis. Without ISM-2051's logging sufficiency, E8-AH-ML3.5 cannot reliably detect events due to missing logs.
This control supports E8-MF-ML3.5.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-2051 because organisations must first ensure software generates sufficient event logs to make meaningful workstation log analysis possible. ISM-2051 addresses log sufficiency/coverage, whereas E8-MF-ML3.5 addresses operational review and timeliness of analysis.
This control supports E8-RA-ML3.9.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-2051 requires software to generate sufficient event logs to support detection, which is a prerequisite for meaningful workstation log analysis. Without ISM-2051-level logging coverage and quality, implementing E8-RA-ML3.9 would be incomplete or ineffective because there may be insufficient events to analyse.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.