Australian Information Security Manual ISM-1228: Analysing cyber security events for incidents

What else in your programme already covers this

This control maps to 11 controls across 5 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ACSC Essential Eight · 4 controls

E8-ADMIN-ISM-1228 Restrict administrative privileges (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents
E8-APP-ISM-1228 Application control (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents
E8-MFA-ISM-1228 Multi-factor authentication (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents
E8-UAH-ISM-1228 User application hardening (ISM-1228): Cyber security events are analysed in a timely manner to identify cyber security incidents

CIS Controls v8 · 2 controls

CIS-17.9 Establish and Maintain Security Incident Thresholds
CIS-8.11 Conduct Audit Log Reviews

ISO 27002:2022 · 2 controls

5.25 Assessment and decision on information security events
8.16 Monitoring activities

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities
NIST-CSF-RS.MA-02 Incident reports are triaged and validated

ATO Digital Service Provider (DSP) Operational Security Framework · 1 control

SEC.MONITOR Security monitoring at network, application and transaction layers

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.