Every response from an ICAP v1.0 server must contain an ISTag value that indicates the current state of the ICAP server.
For instance, when the pattern/scanner version of a virus scanner on the ICAP server changes, the ISTag value changes. This change invalidates all content cached with the previous ISTag value, and a subsequent request for any content in cache must be refetched from the original content server and scanned by the ICAP server.
Eventlog indicating "ISTAG change" is common, and not considered a problem.