ISO 27001 Annex A 8.15 Logging of activities and events
What it says
Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep detailed logs of activities and events to detect attacks and ensure accountability.
This control is about keeping a record of all the important activities and events happening in your organisation's computer systems. It's like having a diary for your systems that can help you spot when something's going wrong, like a cyber-attack, and find out who did it. If you don't keep these records, you might not notice problems until it's too late, and you won't have the information you need to fix them or hold anyone accountable.
Free. Save your status, tasks and notes.
Why it matters
Without comprehensive logs, detecting breaches or issues is delayed, increasing the risk of undetected threats and compromised accountability.
How to implement
The IT manager should set up a logging system that records key activities in the organisation's IT environment.
This includes logging whenever someone logs into a system, tries to access restricted files, or changes critical settings. Follow ISO 27002:2022 by documenting which events need logging and ensuring that logs include user IDs, event timestamps, and details about the event.
Security staff should protect the logs from being altered or erased.
This means limiting access to logs to only those who need to see them, possibly using a secure logging system that can't be tampered with by regular users. Techniques like cryptographic hashing (a way of securing data) and write-once-read-many (WORM) storage can help protect these logs.
A compliance officer or data protection officer should ensure logs don't violate privacy laws.
Update the logging policy to mask any sensitive personal data, such as usernames or IP addresses, in accordance with the Australian Privacy Act 1988 and OAIC guidelines before sending the logs to third-party vendors for troubleshooting.
The IT manager should synchronise time settings across all systems.
This can be done by using a central time server to ensure all logs have accurate and consistent timestamps. Consistent timestamps are crucial when analysing logs to identify unusual patterns or potential security incidents.
The IT security team should regularly review and analyse the logs to spot signs of security breaches.
This analysis can involve checking for repeated failed login attempts, unusual data access, or unexpected system changes. Familiarise themselves with the UEBA (User and Entity Behaviour Analytics) tools and other monitoring tools as per ISO 27002:2022 guidance to detect anomalies.
Keep it running
Regularly review and analyse logs to promptly identify anomalies or trends, ensuring timely incident response and accountability.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the organisation's logging policy documents.
Look at
Check if the policy specifies the types of events to be logged, who has access to the logs, and how the logs are protected.
Good evidence
The logging policy is comprehensive, clearly documented, and aligns with ISO 27002:2022 standards, specifying detailed procedures for log creation and protection.
- Check 2 of 5What an auditor asks for
Ask for
Request access to a sample of logged events.
Look at
Examine if logs contain necessary details such as user IDs, timestamps, and details of activities.
Good evidence
Logs include detailed entries with consistent and accurate information, reflecting all critical events as mandated by the policy.
- Check 3 of 5What an auditor asks for
Ask for
Request evidence of log protection measures.
Look at
Check if logs are stored securely, inaccessible to unauthorised users, and protected against tampering.
Good evidence
Implementation of cryptographic measures, access control measures, and logs stored in append-only formats.
- Check 4 of 5What an auditor asks for
Ask for
Request records of log reviews or analysis reports.
Look at
Look for regular analysis of logs to identify security incidents.
Good evidence
Regularly documented log analysis with outcomes that demonstrate proactive detection and handling of anomalies.
- Check 5 of 5What an auditor asks for
Ask for
Ask for time synchronisation records across systems.
Look at
Verify the use of a centralised time server to synchronise logs.
Good evidence
Presence of logs or system settings that show synced timestamps, aiding in the correlation of events across different systems.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.5, Allowed and blocked application control events are centrally logged, which this control covers in full and more.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.8.
Annex A 6.2.8 requires the organisation to determine at which AI system life cycle phases event logging should be enabled, at minimum when the AI system is in use. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected, and analysed for relevant activities and events, which is directly applicable to AI systems as information systems. Annex A 6.2.8 is AI-specific and lifecycle-phase focused, while Annex A 8.15 is broader and adds expectations for storage/protection/analysis that 6.2.8 does not explicitly mandate.
ASD Essential Eight: 22 mappings
This control is broader than E8-AC-ML2.5.
E8-AC-ML2.5 requires organisations to centrally log allowed and blocked application control events. Annex A 8.15 requires producing, storing, protecting and analysing logs for a broad range of activities, exceptions and faults, which includes (but is not limited to) application control events. E8-AC-ML2.5 is therefore a specific subset implementation of the broader logging expectations in Annex A 8.15.
This control is broader than E8-AC-ML2.6.
E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity and availability for investigation. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes (but is not limited to) protecting logs against tampering and loss. Annex A 8.15 is broader because it also covers log generation and ongoing analysis, whereas E8-AC-ML2.6 focuses specifically on preventing unauthorised change or deletion.
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsBroader than
This control is broader than E8-AC-ML2.7.
E8-AC-ML2.7 requires timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.15 is broader, requiring organisations to produce, store, protect and analyse logs for activities, exceptions and faults across systems. E8-AC-ML2.7 maps to the analysis/detection portion but is narrower in scope (internet-facing servers) and does not explicitly cover log generation, protection, or retention.
This control is broader than E8-AC-ML3.4.
E8-AC-ML3.4 requires timely analysis of event logs specifically from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring logs to be produced, stored, protected and analysed across activities, exceptions and faults. E8-AC-ML3.4 is a specific subset implementation focused on a particular asset class and emphasising timely analysis rather than the full logging lifecycle.
This control is broader than E8-AC-ML3.5.
E8-AC-ML3.5 requires workstation event logs to be analysed promptly to detect security events. ISO/IEC 27001:2022 Annex A 8.15 requires logs of activities and events to be produced, stored, protected, and analysed across the organisation's systems. The overlap is the analysis component, with E8-AC-ML3.5 representing a specific application of Annex A 8.15 focused on workstation logs and timeliness for detection.
This control is broader than E8-AH-ML2.11.
E8-AH-ML2.11 requires organisations to centrally log specific PowerShell telemetry (module logging, script block logging, and transcription). Annex A 8.15 requires logs for activities/events to be produced, stored, protected and analysed, which includes (but is not limited to) the PowerShell events in E8-AH-ML2.11. The ISO control is broader in scope and lifecycle (production through analysis and protection) while the Essential Eight control is a specific high-value Windows/PowerShell logging implementation.
This control is broader than E8-AH-ML2.12.
E8-AH-ML2.12 requires that command line process creation events are centrally logged. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of activities and other relevant events more generally. The primary control is a specific logging requirement that fits within the broader ISO logging control, but ISO also covers log protection and analysis beyond centralisation.
This control is broader than E8-AH-ML2.13.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion. Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes log protection but also covers log generation and ongoing review/analysis. E8-AH-ML2.13 is a specific integrity/retention protection requirement within the broader ISO logging lifecycle control.
This control is broader than E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader because it requires logs to be produced, stored, protected and analysed across the organisation for relevant events. E8-AH-ML2.14 is a specific subset focusing on one high-risk log source (internet-facing servers) and the analysis aspect in particular.
This control is broader than E8-AH-ML3.4.
E8-AH-ML3.4 requires organisations to analyse event logs from non-internet-facing servers in a timely manner to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring logs to be produced, stored, protected and analysed across activities, exceptions and faults for relevant events. E8-AH-ML3.4 maps to the 'analysed' component of Annex A 8.15 for a specific asset scope (non-internet-facing servers) and with an explicit timeliness/detection objective.
This control is broader than E8-AH-ML3.5.
E8-AH-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. Annex A 8.15 requires organisations to produce, store, protect and analyse logs for activities, exceptions and faults across the environment. E8-AH-ML3.5 maps to the 'analyse' expectation but is narrower because it is workstation-specific and does not cover log generation, storage, or protection requirements.
This control is broader than E8-MF-ML2.6.
E8-MF-ML2.6 requires organisations to centrally log successful and unsuccessful MFA events. Annex A 8.15 requires producing, storing, protecting and analysing logs for activities, exceptions, faults and other relevant events, which would include authentication events such as MFA outcomes. E8-MF-ML2.6 is a specific logging use case (MFA success/failure central logging) within the broader ISO logging control.
This control is broader than E8-MF-ML2.7.
E8-MF-ML2.7 requires that event logs cannot be unauthorisedly modified or deleted, focusing on log integrity protections. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes integrity protections as one aspect of overall logging management. E8-MF-ML2.7 is therefore a more specific subset of Annex A 8.15, which also covers log creation and analysis activities.
This control is broader than E8-MF-ML2.8.
E8-MF-ML2.8 requires timely analysis of event logs specifically from internet-facing servers to detect cyber security events. Annex A 8.15 requires logs to be produced, stored, protected and analysed across activities, exceptions and faults, which includes (but is not limited to) internet-facing server logs. E8-MF-ML2.8 is a more specific application of Annex A 8.15 focused on a particular asset class and timeliness for detection.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsBroader than
This control is broader than E8-MF-ML3.4.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader because it covers producing, storing, protecting and analysing logs across activities, exceptions and faults for relevant events, not limited to internal servers. E8-MF-ML3.4 fits within the "analysed" expectation of Annex A 8.15 for a specific log source and scope.
This control is broader than E8-MF-ML3.5.
E8-MF-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. This aligns with Annex A 8.15, which requires organisations to produce, store, protect and analyse logs of relevant events, including faults and exceptions. Annex A 8.15 is broader because it covers the full logging lifecycle and applies across systems, whereas E8-MF-ML3.5 is specifically focused on timely analysis for workstation logs.
This control is broader than E8-RA-ML2.6.
E8-RA-ML2.6 requires privileged access events to be centrally logged to enable monitoring and investigation of administrative misuse. ISO/IEC 27001:2022 Annex A 8.15 requires logs for activities and events to be produced, stored, protected and analysed, which includes privileged actions as part of a broader logging regime. E8-RA-ML2.6 is a specific focus area within the wider logging requirements of Annex A 8.15, and it adds the explicit emphasis on privileged access and centralisation.
This control is broader than E8-RA-ML2.7.
E8-RA-ML2.7 requires central logging of privileged account and group management events. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant activities and events, which is broader than privileged management changes alone and includes log protection and analysis expectations. E8-RA-ML2.7 is a specific logging use case within the wider logging control of Annex A 8.15.
This control is broader than E8-RA-ML2.8.
E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity and availability. This relates directly to Annex A 8.15, which requires logs to be produced, stored, protected, and analysed, including protecting logs as part of an end-to-end logging capability. Annex A 8.15 is broader because it covers log generation and analysis as well as protection, while E8-RA-ML2.8 focuses specifically on preventing unauthorised changes and loss.
This control is broader than E8-RA-ML2.9.
E8-RA-ML2.9 requires timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.15 requires logs to be produced, stored, protected and analysed across activities, exceptions and faults, covering the full logging lifecycle beyond just analysis and beyond just internet-facing servers. E8-RA-ML2.9 is therefore a specific, higher-priority slice of the broader logging control in Annex A 8.15.
This control supports E8-AH-ML2.15.
E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, protected, stored and analysed, which provides the primary evidence stream and telemetry needed to perform that event analysis. Without Annex A 8.15-style logging and log analysis capabilities, E8-AH-ML2.15 cannot be performed consistently across systems because there may be insufficient event data to analyse in the first place.
This control depends on E8-MF-ML2.9.
E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify incidents. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant events, which supports E8-MF-ML2.9 by ensuring the necessary log data exists and is suitable for analysis. Annex A 8.15 is broader across the full logging lifecycle, while E8-MF-ML2.9 is specifically about timely event analysis for incident identification.
ASD Information Security Manual: 57 mappings
This control is broader than ISM-0109.
ISM-0109 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. This implements the analysis element of Annex A 8.15 for one class of system. Annex A 8.15 is broader, requiring logs of activities, exceptions, faults and other events to be produced, stored, protected and analysed across all systems.
This control is broader than ISM-0261.
ISM-0261 requires organisations to centrally log specific web proxy activity details (such as web address, timestamp, user, data volumes, and internal/external IP addresses) for websites accessed via proxies. ISO/IEC 27001:2022 Annex A 8.15 requires logs of relevant activities/events to be produced, stored, protected and analysed, encompassing a broader range of systems and life cycle requirements, while ISM-0261 applies to specific logging content for web proxy traffic.
This control is broader than ISM-0565.
ISM-0565 requires email servers to block, log and report emails that have inappropriate protective markings. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, protect and analyse logs of relevant activities and events, which includes security-relevant email gateway events such as marking violations. ISM-0565 is a specific, email-and-classification-focused logging and enforcement use case within the broader logging control of Annex A 8.15.
This control is broader than ISM-0582.
ISM-0582 stipulates centrally logging security-relevant events on Windows systems. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring organisations to manage logs for all relevant events across systems/ applications. ISM-0582 is a specific technical implementation pattern within Annex A 8.15's wider logging governance.
This control is broader than ISM-0585.
ISM-0585 requires each logged event to capture specific fields (date/time, user or process, filename, description, and the IT equipment involved). ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant events, which presumes logs contain enough context to be useful. Annex A 8.15 is broader because it governs the end-to-end logging lifecycle, while ISM-0585 is a detailed content requirement for individual log records.
This control is broader than ISM-0634.
ISM-0634 requires security-relevant events for gateways to be centrally logged, specifically covering permitted flows, attempted egress, and real-time intrusion alerts. Annex A 8.15 requires organisations to produce, store, protect and analyse logs for relevant activities and events across the environment. ISM-0634 is a specific application of the broader ISO logging requirement focused on gateway telemetry and centralisation.
This control is broader than ISM-0670.
ISM-0670 requires security-relevant events for CDSs to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 relates by requiring logs of relevant events to be produced, stored, protected, and analysed across the organisation. ISM-0670 is narrower because it is specific to CDSs and emphasises central logging, whereas Annex A 8.15 is broader and includes protection and analysis in addition to creation and storage.
This control is broader than ISM-1030.
ISM-1030 requires NIDS/NIPS-generated event logs and alerts for gateway traffic that breaches firewall rules. Annex A 8.15 requires producing, storing, protecting and analysing logs for activities, exceptions and other relevant events across the organisation's systems. ISM-1030 is a specific log source and alerting requirement at the perimeter, while Annex A 8.15 is broader log management and analysis across many systems and does not prescribe IDS/IPS deployment or placement.
This control is broader than ISM-1213.
ISM-1213 mandates the capture and analysis of full network traffic for seven days post-intrusion remediation for validation. Annex A 8.15 requires producing and analysing logs, including network security logs. ISM-1213 is narrower, focusing on a specific source and post-remediation period, versus the broader logging and analysis in Annex A 8.15.
This control is broader than ISM-1294.
ISM-1294 requires data transfer logs for systems to be partially verified at least monthly. Verifying these logs is a specific form of the log analysis required by Annex A 8.15, which requires logs of activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. Annex A 8.15 covers the full logging life cycle for all event types, whereas ISM-1294 addresses only periodic review of data transfer logs.
This control is broader than ISM-1509.
ISM-1509 requires that privileged access events are centrally logged to support monitoring and response. ISO/IEC 27001:2022 Annex A 8.15 requires producing, storing, protecting and analysing logs of relevant activities and events across the organisation. ISM-1509 is a specific subset focused on centralising logs for privileged access events, whereas Annex A 8.15 is broader in both scope and lifecycle.
This control is broader than ISM-1536.
ISM-1536 requires central logging for all software-to-database queries and any resulting crash or error messages. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, store, protect and analyse logs of activities, exceptions and faults more generally across systems. ISM-1536 is a specific implementation subset focused on database query and application error/crash logging, while Annex A 8.15 covers broader logging requirements including protection and analysis.
This control is broader than ISM-1537.
ISM-1537 requires organisations to centrally log a defined set of security-relevant database events (e.g. privileged changes, key content access/modification, DBA actions, logons/logoffs, and risky query patterns). Annex A 8.15 requires logs of relevant activities/events to be produced, stored, protected and analysed across the organisation's systems. ISM-1537 is a specific database-focused instantiation of the broader ISO logging requirement, with more prescriptive database event categories.
This control is broader than ISM-1566.
ISM-1566 requires that use of unprivileged access is centrally logged to provide visibility of non-admin user activity. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant activities and events, which includes (but is not limited to) unprivileged access logging. Annex A 8.15 is broader because it covers many event types plus log protection and analysis, whereas ISM-1566 is specifically about central logging of unprivileged access.
This control is broader than ISM-1586.
ISM-1586 requires data transfer logs to record all data imports and exports, aligning with Annex A 8.15's broader requirement to produce, store, protect, and analyse logs of various activities. While Annex A 8.15 covers a wider range of events and includes protection and analysis expectations, ISM-1586 specifically focuses on logging data import/export activities.
This control is broader than ISM-1613.
ISM-1613 requires central logging specifically for break glass account usage. Annex A 8.15 requires organisations to produce, protect, store and analyse logs for activities and relevant events across systems. ISM-1613 is a specific, emergency-access-focused instance of the broader logging governance and coverage expected by Annex A 8.15.
This control is broader than ISM-1623.
ISM-1623 requires centralised logging specifically for PowerShell module, script block and transcription events. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant activities and events more broadly across systems and applications. ISM-1623 is a specific implementation instance within the broader logging expectations of Annex A 8.15.
This control is broader than ISM-1650.
ISM-1650 requires central logging of privileged user account and security group management events. Annex A 8.15 is broader as it requires organisations to produce, store, protect and analyse logs for a wide range of activities and events, not limited to privileged identity management. ISM-1650 fits within Annex A 8.15 as a specific logging use case focused on privileged account and group changes.
This control is broader than ISM-1683.
ISM-1683 requires successful and unsuccessful MFA events to be centrally logged. Annex A 8.15 requires organisations to produce, store, protect, and analyse logs for relevant activities and events more broadly. ISM-1683 is a specific application of Annex A 8.15 focused on one high-value event type (MFA outcomes) and the centralisation aspect, while Annex A 8.15 covers a wider range of events and additional log handling expectations.
This control is broader than ISM-1830.
ISM-1830 requires centrally logging security-relevant events specifically from Microsoft AD DS domain controllers, AD CS, AD FS and Entra Connect servers. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring organisations to produce, store, protect and analyse logs of relevant activities and events across information systems generally. ISM-1830 is a prescriptive, identity-infrastructure-specific implementation pattern that would partially satisfy Annex A 8.15 for that subset of systems but not for the wider environment.
This control is broader than ISM-1855.
ISM-1855 requires organisations to centrally log multifunction device (MFD) use for printing, scanning and copying, including capturing shadow copies of documents. This is a specific instance of ISO/IEC 27001:2022 Annex A 8.15, which requires logs of relevant activities and events to be produced, stored, protected and analysed across information systems. Annex A 8.15 is broader (covers all relevant systems and includes protection/analysis expectations), while ISM-1855 focuses on one high-risk asset class (MFDs) and the specific event content to capture.
This control is broader than ISM-1889.
ISM-1889 requires a specific class of security-relevant logging: centrally recording command line process creation events. Annex A 8.15 requires organisations to produce, store, protect and analyse logs for a broad range of activities and events. ISM-1889 is therefore a concrete, narrower implementation that would contribute to meeting Annex A 8.15 but does not cover its full logging lifecycle or breadth of event types.
This control is broader than ISM-1895.
ISM-1895 requires central logging of successful and unsuccessful single-factor authentication events. ISO/IEC 27001:2022 Annex A 8.15 requires logs of activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed, which encompasses authentication event logging as one type of relevant event. ISM-1895 is therefore a specific application of the broader logging control in Annex A 8.15, with a tighter focus on single-factor authentication outcomes and centralisation.
This control is broader than ISM-1906.
ISM-1906 requires timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.15 is broader because it requires logs to be produced, stored, protected and analysed for activities, exceptions and faults across relevant systems. ISM-1906 aligns specifically to the 'analysed' aspect for a particular high-risk system class (internet-facing servers) and does not address log generation, retention, or protection requirements in Annex A 8.15.
This control is broader than ISM-1911.
ISM-1911 requires the centralisation of security-relevant software usage, error messages, and crashes. ISO/IEC 27001:2022 Annex A 8.15 mandates the production, storage, protection, and analysis of activity logs, exceptions, and faults generally. ISM-1911's specific focus on software centralisation is encompassed within the broader requirements of Annex A 8.15.
This control is broader than ISM-1937.
ISM-1937 requires organisations to check Active Directory user accounts at least weekly for the presence of the sIDHistory attribute, which is a specific directory-attribute audit to detect privilege inheritance and persistence risks. ISO/IEC 27001:2022 Annex A 8.15 requires logs of relevant events to be produced, protected and analysed, which can include directory service and account-management/auditing events that help detect or investigate unauthorised changes related to sIDHistory. Annex A 8.15 is broader and logging-centric, while ISM-1937 is a specific operational identity control focused on detecting sIDHistory directly (not just via logs).
This control is broader than ISM-1959.
ISM-1959 requires that, to the extent possible, event logs are captured and stored in a consistent and structured format. This relates directly to ISO/IEC 27001:2022 Annex A 8.15, which requires logs to be produced, stored, protected, and analysed. ISM-1959 is a specific quality/normalisation requirement within the broader logging lifecycle obligations in Annex A 8.15.
This control is broader than ISM-1963.
ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of activities and relevant events across systems more broadly, which includes centralising logs as a common implementation. ISM-1963 is a specific application of Annex A 8.15 limited to internet-facing network devices and central logging (not the full lifecycle of log protection and analysis).
This control is broader than ISM-1964.
ISM-1964 requires security-relevant events for non-internet-facing network devices to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 (Logging of Activities and Events) is broader, requiring logs of relevant events to be produced, stored, protected and analysed across systems. ISM-1964 is a specific application of Annex A 8.15 focused on centralising logs for a particular asset class (internal network devices) rather than covering protection and analysis requirements.
This control is broader than ISM-1978.
ISM-1978 requires security-relevant events for server applications on internet-facing servers to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring logs of relevant events to be produced, stored, protected and analysed across the organisation's environment. ISM-1978 is a specific subset focused on centralised logging for internet-facing server applications and does not, by itself, cover the full lifecycle requirements (protection/analysis) for all logs.
This control is broader than ISM-1979.
ISM-1979 requires security-relevant events for server applications on non-internet-facing servers to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 requires logs of relevant events to be produced, stored, protected and analysed across the organisation, which includes server application events but extends beyond them. ISM-1979 is a specific implementation focus (central logging for non-internet-facing servers) within the broader logging lifecycle required by Annex A 8.15.
This control is broader than ISM-1983.
ISM-1983 requires event logs to be sent to a centralised event logging facility as soon as possible after they occur. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant activities and events, covering the end-to-end logging lifecycle. Centralised, timely forwarding in ISM-1983 is one implementation approach that supports Annex A 8.15's broader requirements, but Annex A 8.15 also includes protection and analysis not addressed by ISM-1983.
This control is broader than ISM-1984.
ISM-1984 requires that event logs forwarded to a centralised event logging facility are encrypted in transit to protect them against interception and tampering during transmission. This supports ISO/IEC 27001:2022 Annex A 8.15 because Annex A 8.15 requires logs to be produced, stored and protected, and secure transport is a specific protection mechanism for the log-handling process when logs are transmitted to central storage/analysis. Annex A 8.15 remains broader because it also covers log creation, retention, access control, and analysis, whereas ISM-1984 is limited to transport encryption for forwarded logs.
This control is broader than ISM-1985.
ISM-1985 requires that event logs are protected from unauthorised access. Annex A 8.15 relates by requiring logs be produced, stored, protected and analysed, explicitly including protection of logs as part of a full logging lifecycle. ISM-1985 is narrower because it focuses specifically on preventing unauthorised access, whereas Annex A 8.15 also covers generation, retention/storage controls and analysis activities.
This control is broader than ISM-1986.
ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader as it covers log production, storage, protection, and analysis across the organisation. ISM-1986 focuses on log analysis for critical servers.
This control is broader than ISM-1987.
ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, covering the full logging lifecycle and associated safeguards. ISM-1987 aligns to the 'analysed' component (with an emphasis on timeliness for detection) but does not cover log generation, protection and retention to the same breadth as Annex A 8.15.
This control is broader than ISM-1988.
ISM-1988 requires event logs to be retained in a searchable manner for at least 12 months. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes (but does not mandate) retention duration and searchability. ISM-1988 is therefore a specific retention/searchability requirement within the broader logging lifecycle expectations of Annex A 8.15.
This control is broader than ISM-2015.
ISM-2015 mandates central logging for specific data-affecting non-internet API calls. Annex A 8.15 requires logging of activities and significant events across systems, which encompasses API activities where applicable. Hence, ISM-2015 enforces a more specific aspect of the broader logging requirement found in Annex A 8.15, concentrating on internal API interactions.
This control is broader than ISM-2051.
ISM-2051 requires that software generates sufficient event logs to support detection of cyber security events. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected, and analysed, covering more than just the generation sufficiency for detection as in ISM-2051.
This control is broader than ISM-2052.
ISM-2052 requires that event logs produced by software protect any sensitive data contained within them. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes protecting log content and the log repositories. ISM-2052 is more specific to safeguarding sensitive data in logs (e.g., preventing exposure of secrets/PII in log entries), while Annex A 8.15 is broader across the full logging lifecycle including analysis and operational handling.
This control is broader than ISM-2089.
ISM-2089 requires organisations to monitor AI model performance metrics and investigate anomalies. Annex A 8.15 requires logs of activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed, which provides the logging and analysis foundation for detecting and investigating AI model anomalies. ISM-2089 focuses on AI-specific signals (e.g. drift, unexpected output patterns, abnormal error rates), while Annex A 8.15 is broader logging governance across all systems and applications.
This control is broader than ISM-2125.
ISM-2125 requires a specific logging and monitoring outcome: independently log all service provider access such that the provider cannot alter logs, and analyse them promptly for suspicious activity. Annex A 8.15 requires organisations to produce, store, protect and analyse logs for relevant activities and events more generally across the environment. ISM-2125 is a more specific instance of Annex A 8.15 focused on supplier access and independence from the service provider, while Annex A 8.15 covers broader event categories and does not explicitly require independence from a third party.
This control is broader than ISM-2129.
ISM-2129 requires WMI activity, including creation of permanent event subscriptions, to be centrally logged. ISO/IEC 27001:2022 Annex A 8.15 requires logs of activities, exceptions, faults and other relevant events to be produced, stored, protected, and analysed across the environment. ISM-2129 is a specific, technology-scoped implementation that contributes to Annex A 8.15's broader logging and log management expectations.
- ISM-2132Central logging of certificate enrolment requests, template and AD CS configuration changesBroader than
This control is broader than ISM-2132.
ISM-2132 requires central logging of certificate enrolment requests (successful/unsuccessful) and changes to certificate templates or Microsoft AD CS configurations. ISO/IEC 27001:2022 Annex A 8.15 broadly requires producing, storing, protecting, and analysing logs of relevant events across the organisation. ISM-2132 is a specific PKI/AD CS implementation case that fits within the broader logging expectations of Annex A 8.15, but does not cover the full range of events or the full set of log management lifecycle requirements.
This control is broader than ISM-2139.
ISM-2139 requires that third-party OAuth consent, token issuance, and token use events are centrally logged for traceability and investigation. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring logs of activities and relevant events to be produced, stored, protected, and analysed across systems generally. ISM-2139 is a specific, identity-provider/OAuth-focused instantiation of the broader logging control in Annex A 8.15.
This control is broader than ISM-2159.
ISM-2159 requires that all agentic AI tool invocations, external requests, and outputs are centrally logged with enough detail to support cyber security incident investigations. ISO/IEC 27001:2022 Annex A 8.15 requires that logs of activities, exceptions, faults, and other relevant events are produced, stored, protected, and analysed, which is a broad organisational logging requirement that would include AI application/agent events as a subset. ISM-2159 is more prescriptive about the specific AI-agent event types (tool calls, outbound requests, generated outputs) and centralisation, whereas Annex A 8.15 covers logging across all systems and event classes.
This control partially overlaps ISM-0580.
Annex A 8.15 requires that logs are produced, stored, protected, and analysed to support detection and accountability. Control ISM-0580 relates by requiring an event logging policy to be developed, implemented, and maintained, governing how logging is performed and managed. The primary control is more operational, whereas the ISM control focuses on governance aspects.
This control partially overlaps ISM-1405.
ISM-1405 requires a centralised event logging facility to collect and manage event logs in one location. Annex A 8.15 requires logs to be produced, stored, protected and analysed, which commonly includes centralised log collection as part of storage and analysis. Annex A 8.15 is broader because it covers the full logging lifecycle (generation, protection and analysis), while ISM-1405 focuses specifically on the centralised facility component.
This control partially overlaps ISM-1989.
ISM-1989 requires event logs to be retained in line with minimum retention periods defined by the National Archives of Australia (AFDA Express). Annex A 8.15 requires that logs are produced, stored, protected and analysed, which necessarily includes keeping logs for a period of time. However, Annex A 8.15 does not specify Australian archival retention obligations, while ISM-1989 is focused specifically on records retention compliance rather than broader logging lifecycle controls.
This control partially overlaps ISM-2046.
ISM-2046 requires secure logging practices in impersonation scenarios, such as preventing sensitive data from being logged and ensuring appropriate permissions. Annex A 8.15 overlaps by requiring logs to be produced, stored, protected, and analysed, which includes controlling access to logs and protecting them from tampering. However, Annex A 8.15 is broader, and does not explicitly require suppression or redaction of sensitive data in logs for impersonation use cases as ISM-2046 does.
This control supports ISM-0661.
ISM-0661 requires that human users who transfer data into or out of systems are identifiable and accountable for those specific transfer actions. ISO/IEC 27001:2022 Annex A 8.15 supports this by requiring logging of relevant activities and events so transfers can be attributed to a specific user and later reviewed. Annex A 8.15 is broader in that it covers all security-relevant events (not just data transfers), but without adequate logging, ISM-0661 accountability is difficult to evidence.
This control supports ISM-1228.
ISM-1228 requires organisations to analyse cyber security events promptly to identify incidents. Annex A 8.15 requires logs to be produced, stored, protected and analysed, providing the core telemetry and integrity needed for reliable event analysis. In practice, effective implementation of ISM-1228 depends on Annex A 8.15-like logging being in place so that there are trustworthy events to analyse in the first place.
This control depends on ISM-0988.
Annex A 8.15 necessitates logs to be produced and analysed for detection, investigation, and accountability. ISM-0988 supports this by ensuring an accurate and consistent time source essential for reliable log correlation and chronology and evidentiary value. This ISM control is enabling for log integrity rather than directly handling log production or analysis.
- ISM-1526System owners continuously monitor security and manage threats, risks and controlsDepends on
This control depends on ISM-1526.
ISM-1526 requires system owners to continuously monitor system security and manage cyber threats, risks and controls for each system. ISO/IEC 27001:2022 Annex A 8.15 supports this by requiring logs to be produced, protected and analysed, enabling the monitoring evidence and detection capability owners rely on. Annex A 8.15 is focused on logging controls, whereas ISM-1526 also includes defining boundaries/objectives and overarching risk ownership.
This control depends on ISM-2116.
ISM-2116 requires using cyber threat intelligence services to support detection of cyber security events and identification of incidents. Annex A 8.15 requires producing, protecting and analysing logs, which provides the telemetry that CTI can be applied to for detection and triage. ISM-2116 focuses on the intelligence-driven aspect of detection, while Annex A 8.15 focuses on the logging capability needed to make that use of CTI effective.
This control depends on ISM-2117.
ISM-2117 requires suitable AI models to augment detection of cyber security events and identification of incidents. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, protect and analyse logs of activities and events, providing the telemetry and data quality foundation that AI models typically need to detect events and support incident identification. ISM-2117 can be significantly constrained or ineffective without robust logging coverage and retention as required by Annex A 8.15.
This control depends on ISM-2153.
ISM-2153 requires quarterly threat hunting informed by threat intelligence to actively search for hidden intruders. Annex A 8.15 demands the production and analysis of logs, essential for forming and validating hunting hypotheses. ISM-2153 is about proactive searching, while Annex A 8.15 ensures the log analysis capacity exists.
ASD Essentials for enterprise IT: 5 mappings
This control is broader than IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including by encrypting them in transit and at rest and securing the systems and accounts used to store, manage and analyse them. This is a specific implementation of the protection element of Annex A 8.15, which requires logs recording activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. Annex A 8.15 covers the whole logging life cycle, while IT.DET-01.1 addresses protection only but is more prescriptive about how it is achieved.
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storageBroader than
This control is broader than IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to be forwarded to a central log storage capability. This is a specific implementation of the production and storage elements of Annex A 8.15, which requires logs of activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. Annex A 8.15 also covers the protection and analysis of logs but does not require them to be centralised.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingBroader than
This control is broader than IT.DET-01.3.
IT.DET-01.3 requires a centralised event log storage capability that protects logs from unauthorised access or modification. This is a specific implementation of the storage and protection elements of Annex A 8.15, which requires logs to be produced, stored, protected and analysed. Annex A 8.15 also covers producing and analysing logs and does not require storage to be centralised.
- IT.DET-02.1Normalise, time-synchronise and enrich event logs for cross-system correlationBroader than
This control is broader than IT.DET-02.1.
IT.DET-02.1 requires event logs to be normalised, time-synchronised and enriched to support correlation across systems and environments. This strengthens the analysis element of Annex A 8.15, which requires logs recording activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. Annex A 8.15 covers the whole logging life cycle, while IT.DET-02.1 addresses the consistency and context of log data needed for effective correlation.
- IT.PRO-05.3Log every administrative and management change with user, timestamp and targetBroader than
This control is broader than IT.PRO-05.3.
IT.PRO-05.3 requires all administrative or management actions that modify systems, configurations or controls to be recorded with the associated user, timestamp and target. This is a specific logging requirement within Annex A 8.15, which requires logs of activities and other relevant events to be produced, stored, protected and analysed. Annex A 8.15 is broader, covering all relevant events as well as the storage, protection and analysis of logs, which IT.PRO-05.3 does not address.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation