Updated 2026-06-14
How Australian ISM logging themes apply to MSP remote management-security audit vs HTTP logs, export, and consumer SSP responsibilities.
Visual anchor before the full guide below.
compliance
How Australian ISM logging themes apply to MSP remote management-security audit vs HTTP logs, export, and consumer SSP responsibilities.
Australian Information Security Manual (ISM) guidance expects agencies to log security-relevant events, protect log integrity, and support incident investigation. Remote access tools-including MSP management planes that execute PowerShell-fall inside system boundaries when agencies or regulated supply chains use them.
Trustholm does not claim ISM product endorsement. We describe how shipped logging surfaces help consumers meet logging themes when Trustholm is part of a assessed system-and where gaps require customer compensating controls.
Security audit records privileged actions: script publish, approve, policy change, IAM updates, execution attribution. Export via /audit and GET /api/audit/export.
HTTP request logs support operations: latency, errors, request paths. Serilog enrichment adds tenant_id, tenant_code, and correlation_id when deployed-useful for chargeback and triage, not a substitute for security audit on script execution.
ISM assessors want clarity on which plane satisfies which control statement. Conflating them creates findings.
When Trustholm is in scope, typical event families include:
Map each family to retention period, storage location, and review cadence you operate.
Application flows append audit rows. Database operators with sufficient privilege could mutate data. WORM storage or hash-chain verification is backlog in Trustholm's architecture roadmap.
Consumer SSP should state compensating controls: restricted DBA roles, infrastructure change logging, frequent export to agency-controlled immutable store.
JSON/CSV export supports manual or scripted ingestion to Splunk, Sentinel, or Elastic stacks you maintain. Native Microsoft Sentinel connector (DCR/Event Hub) and ASIM normalization are not shipped-document as planned or out-of-scope with alternative ingestion design.
ISM discussions often mix interactive remote desktop with scripted management. Trustholm focuses on script orchestration with audit attribution-not a full RDP replacement. Scope SSP language to management-plane actions your agency actually uses.
If you use Trustholm across mixed client base, segment export evidence per client using tenant customer/group scoping practices. Agency assessments may require per-system boundaries-do not reuse one export blindly across unrelated classifications.
Logging supports detect and respond-but only with IR runbooks, escalation paths, and tested restoration. Trustholm supplies export for investigation; incident response runbook remains consumer-authored (see compliance docs in repository for template patterns, not attestation claims).
"The management plane records privileged script and IAM events in a dedicated security audit store distinct from HTTP request logs. Exports occur on a defined cadence to agency-controlled immutable storage.
Real-time SIEM ingestion uses customer-operated forwarding; native vendor Sentinel connector is not in scope for this deployment. "
Document who approves retention period changes, where archived exports live geographically, and how you test restore from immutable storage annually. ISM assessors often request proof of review-not just policy PDFs. Pair Trustholm export samples with your log review ticket queue showing human acknowledgment of anomalies detected in forwarded HTTP logs.
See /trust/audit-and-logging for API paths and /compliance/au/essential-eight for enabler framing. ISM outcomes remain consumer-owned.
Assign a reviewer to open trial tenant, navigate documented UI paths, and capture screenshots with timestamps. Export audit JSON for same session.
Store in immutable GRC folder. Compare results to this article quarterly.
When Shipped/Gap rows change in trust hub, re-run reproduction within ten business days. Attach limitations memo for WORM audit and Sentinel connector backlog.
Include DB operator access policy from hosting provider. Pair technical evidence with customer governance documents-policies, pentest summaries, IR runbooks.
Never substitute marketing copy for reproduced checks in front of assessors. Treat this appendix as a living runbook section owned by security engineering, not a one-time audit artifact.
Schedule annual refresh aligned with trust hub version stamps and major product releases. Link each reproduction run to a change ticket for traceability.
Distribute updated article PDFs to customer-facing teams when dateModified changes. Archive prior versions for twelve months to support assessor lookback questions.
When citing this article externally, include dateModified and pillar metadata in footnotes so readers know content freshness. Internal enablement should link pillar tags to trust hub sections for consistent customer messaging.
Add article slug to internal wiki index for sales engineering quick lookup during live questionnaire calls.
No product alone meets ISM. Consumers implement retention, integrity, monitoring, and review processes around vendor artifacts. Gaps must be disclosed in SSP.
Platform settings and your database operations define retention. Contractual and SSP retention targets are consumer-defined-not universal vendor guarantees.
HTTP log forwarding is deployment-dependent. Security audit real-time streaming via native Sentinel connector is backlog-build interim export scripts or log agents.
Heartbeat traffic appears in operational telemetry paths-not security audit privileged action table. Document separately.
Both are consumer programs. ISM logging depth may exceed E8 logging minimums. Use evidence tables for both without conflating certification claims.