ASD Essentials IT.PRO-05.3 Log Every Administrative and Management Change with User, Timestamp and Target
What it says
Record all administrative or management actions that modify systems, configurations or controls, including the details of the associated user, timestamp and target.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRecords every admin or management change to systems, settings and security controls, showing who made it, when and what it changed.
Administrators and their tools can change almost anything, so every change they make must be recorded. To meet this, log every change to internet-facing, identity, critical and admin systems, however it is made. Each record names the person or account, gives an accurate time, and shows the target and what changed. For example, a firewall rule edit shows who changed which rule, when, and the old and new values.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems (does not apply)
- User devices (does not apply)
Why it matters
Without these records, nobody can tell an approved change from a mistake or an attacker's work. An intruder with admin access can add accounts, switch off security tools or plant harmful software unnoticed. Their changes can also stay after the attack is cleaned up.
How to implement
The logging lead should publish a standard requiring every change to systems, settings and security controls to be recorded.
Each record shows who, when, the target and what changed, and a register lists every in-scope system.
Platform owners should switch on audit logging on every registered system, starting with firewalls and other internet-facing devices, directories, sign-in services and password vaults.
Then cover critical systems and management consoles, such as virtual server and cloud consoles.
Platform owners and automation engineers should also record changes made by command line, script, programming interface (API) or automated job, not just in consoles.
Tie each automated action to the person, job or release process that triggered it.
Logging engineers should make each record name the individual administrator (no shared logins) and carry an accurate, synchronised time.
It must also show the target and what changed, such as old and new values, using advanced audit options if needed.
The logging team should send records to a central log system and re-check audit settings regularly.
Make test changes on sample systems to prove records arrive complete, and track every gap until fixed.
Keep it running
Platform owners switch on audit logging and test it before any new system or admin tool goes live. The logging team watches that every system keeps sending records. A system that goes quiet, or logging switched off, can mean someone is covering their tracks. Close existing gaps in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the system register and the central log system's list of audit sources.
Look at
Whether any registered system sends no audit records, such as edge devices, password vaults or management consoles.
Good evidence
Every in-scope system logs admin changes, and the two lists match with no unexplained gaps.
- Check 2 of 5What an auditor asks for
Ask for
Request audit settings exports for sampled systems in each ASD domain.
Look at
Whether every kind of change is recorded, including command-line, API and automated changes.
Good evidence
Logging is on for console, command-line, API and automated changes on every sampled system.
- Check 3 of 5What an auditor asks for
Ask for
Request raw audit records for a sample of recent admin changes.
Look at
Whether records show who, when and what, or give the action but leave out the target or change.
Good evidence
Each sampled record names the person or job, an accurate time, the target and what changed.
- Check 4 of 5What an auditor asks for
Ask for
Ask for audit entries matching a sample of approved, emergency and automated changes.
Look at
Whether changes are missing, logged only under shared accounts, or show different times or targets.
Good evidence
Every sampled change appears in the audit records, traced to a named person or account.
- Check 5 of 5What an auditor asks for
Ask for
Request records of systems that stopped sending logs, and changes to logging settings, for the period.
Look at
Whether systems stopped sending records, or logging was reduced or switched off without approval.
Good evidence
Logging stays on throughout, and any gap or settings change is recorded, explained and fixed.
ASD indicators of good practice (6)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1Administrative or management actions that modify systems, configurations or controls are not logged.
- NE-2Logs do not capture sufficient detail to identify who made a change, when and to what target.
Partially effective(2)
- PE-1Logging is enabled and provides useful coverage, but does not cover all applicable administrative or management platforms.
- PE-2Logs capture the administrator identity and action but lack detail on the target or change nature.
Fully effective(2)
- FE-1Comprehensive audit logging to capture all administrative or management actions is enabled on all platforms in scope.
- FE-2Logs capture administrator identity, timestamp, target object and nature of change.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of Activities and Events, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
IT.PRO-05.3 requires all administrative or management actions that modify systems, configurations or controls to be recorded with the associated user, timestamp and target. This is a specific logging requirement within Annex A 8.15, which requires logs of activities and other relevant events to be produced, stored, protected and analysed. Annex A 8.15 is broader, covering all relevant events as well as the storage, protection and analysis of logs, which IT.PRO-05.3 does not address.
This control supports A.8.2.
IT.PRO-05.3 requires all administrative or management actions that modify systems, configurations or controls to be recorded with the associated user, timestamp and target. Recording administrative actions provides accountability for the use of privileged access, which supports the management of privileged access rights under Annex A 8.2. Annex A 8.2 focuses on restricting and managing privileged access rights, while IT.PRO-05.3 addresses only the recording of administrative activity.
This control supports A.8.32.
IT.PRO-05.3 requires all administrative or management actions that modify systems, configurations or controls to be recorded with the associated user, timestamp and target. This record of the changes actually made supports Annex A 8.32 by allowing changes to be reconciled against approved change management procedures and unauthorised changes to be detected. Annex A 8.32 governs the change process itself, while IT.PRO-05.3 provides the audit trail of changes.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-RA-ML2.6.
IT.PRO-05.3 requires every administrative change to systems, configurations or controls to be recorded with the user, timestamp and target; E8-RA-ML2.6 requires privileged access events to be centrally logged, overlapping on recording administrative activity.
- E8-RA-ML2.7Centrally log privileged user account and security group management eventsPartially overlaps
This control partially overlaps E8-RA-ML2.7.
IT.PRO-05.3 requires every administrative change to systems, configurations or controls to be recorded with the user, timestamp and target; E8-RA-ML2.7 requires privileged user account and security group management events to be centrally logged, a specific case of those changes.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-0585.
IT.PRO-05.3 requires every administrative change to systems, configurations or controls to be recorded with the user, timestamp and target; ISM-0585 requires each logged event to capture the date and time, user or process, filename, description and equipment involved, overlapping on those details.
This control partially overlaps ISM-1566.
IT.PRO-05.3 requires every administrative change to systems, configurations or controls to be recorded with the user, timestamp and target; ISM-1566 requires use of unprivileged access to be centrally logged, complementing it by logging unprivileged rather than administrative activity.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.