Australian Information Security Manual

Guidelines for system monitoring

Australian Information Security Manual ISM-1987: Event logs from security products are analysed in a timely manner to detect cyber security

Event logs from security products are analysed in a timely manner to detect cyber security events.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for system monitoring

ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security even
ISM-0580 An event logging policy is developed, implemented and maintained.
ISM-0585 For each event logged, the date and time of the event, the relevant user or process, the r
ISM-0988 An accurate and consistent time source is used for event logging.
ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents
ISM-1405 A centralised event logging facility is implemented.
ISM-1815 Event logs are protected from unauthorised modification and deletion.
ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber se

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls