Essential Eight AH-ML2.13 Protect event logs from unauthorised changes or deletion
What it says
Event logs are protected from unauthorised modification and deletion.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure event logs cannot be tampered with or erased without permission.
This control is about making sure that important computer records, known as event logs, can't be changed or erased without the right permissions. Without this protection, someone with bad intentions could hide their tracks after doing something harmful to a computer system.
Free. Save your status, tasks and notes.
Why it matters
If event logs can be altered or deleted without detection, attackers can hide malicious activity, undermining forensic investigations and accountability for incidents.
How to implement
System administrators should ensure event logs are stored in a secure location.
This can be done by configuring the system to save logs on a separate, protected server.
The IT security team should set up access controls on the event log files.
They can do this by restricting permissions so that only authorised personnel can make changes.
System administrators should regularly back up event logs.
Use automated backup tools to schedule and store backups safely.
Security officers should implement log monitoring.
Set up alerts for any changes to the logs, which can be achieved through monitoring software.
The IT team should enable 'audit log integrity' features when available.
This will add an extra layer of protection by ensuring log files are not tampered with.
Keep it running
Store logs on WORM or immutable storage and restrict log admin access; enable auditing/alerting on log changes to prevent unauthorised modification or deletion.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you ensure the event logs are protected from unauthorised changes?
Look at
Review the access control settings for the event logs.
Good evidence
Access controls are in place, limiting changes to authorised personnel only.
- Check 2 of 2What an auditor asks for
Ask for
How do you make sure that event logs are regularly backed up?
Look at
Check the schedule and location of log backups.
Good evidence
Automated backups are set up to occur nightly, stored securely.
Mappings
Closest match in ASD Information Security Manual: ISM-1815, Protect event logs from unauthorised access, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.33.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity for detection and investigation. Annex A 5.33 requires protection of records from loss, destruction, falsification and unauthorised access/release, which can include logs when treated as organisational records. Annex A 5.33 is broader (all records and more threat types), while E8-AH-ML2.13 is focused specifically on event log tampering and erasure.
This control partially meets A.8.15.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion. Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes log protection but also covers log generation and ongoing review/analysis. E8-AH-ML2.13 is a specific integrity/retention protection requirement within the broader ISO logging lifecycle control.
This control supports A.5.28.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion so they remain trustworthy. Annex A 5.28 requires procedures to collect and preserve evidence related to information security events, which relies on tamper-resistant logs as a key evidence source. E8-AH-ML2.13 strengthens the reliability of evidence handled under Annex A 5.28, but does not by itself establish end-to-end evidence handling procedures.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1815.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion to prevent tampering. ISM-1815 states the same requirement, explicitly mandating protection of event logs from unauthorised modification and deletion. Both controls have the same security outcome and scope (log integrity and availability against unauthorised change).
This control partially meets ISM-1624.
ISM-1624 requires PowerShell script block logs to be protected using Protected Event Logging functionality. E8-AH-ML2.13 requires protection of event logs from unauthorised modification and deletion at a general level, which includes PowerShell event logs. ISM-1624 is a more specific requirement focused on a particular Windows logging feature and log source, while E8-AH-ML2.13 is broader and does not prescribe a specific mechanism.
This control partially meets ISM-1985.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion. ISM-1985 focuses on protecting event logs from unauthorised access, which is related but does not necessarily prevent alteration or deletion by an authorised-but-malicious actor. Protecting access supports integrity, but E8-AH-ML2.13 is more specific about tamper/erase resistance.
This control partially overlaps ISM-0582.
ISM-0582 requires central logging of security-relevant events for Windows. E8-AH-ML2.13 relates by protecting event logs from modification, necessary to ensure logged Windows events remain trustworthy. ISM-0582 addresses log collection, while E8-AH-ML2.13 assures log integrity.
This control partially overlaps ISM-2125.
ISM-2125 requires that all service provider access to an organisation's systems is independently logged by the organisation in a tamper-resistant way and analysed promptly for anomalous or unauthorised activity. E8-AH-ML2.13 aligns with the tamper-resistance portion by requiring event logs be protected from unauthorised modification or deletion, which supports the 'service provider cannot modify or delete' requirement. However, ISM-2125 is narrower in focus on service provider access and adds the requirement for independent organisational logging and timely analysis, which E8-AH-ML2.13 does not explicitly cover.
- ISM-2132Central logging of certificate enrolment requests, template and AD CS configuration changesPartially overlaps
This control partially overlaps ISM-2132.
ISM-2132 requires central logging of certificate enrolment activity and changes to certificate templates and AD CS configurations. E8-AH-ML2.13 requires protection of event logs from unauthorised modification or deletion, which is necessary to preserve the evidentiary value of the certificate-related logs collected under ISM-2132. ISM-2132 is focused on what PKI events must be logged centrally, while E8-AH-ML2.13 is focused on safeguarding logs regardless of the event type.
This control supports ISM-0138.
E8-AH-ML2.13 requires protecting event logs from unauthorised modification and deletion, helping ensure logs can be relied on during incident response. ISM-0138 focuses on maintaining integrity of evidence during investigations via action recording and chain of custody, for which untampered logs are often a primary input. E8-AH-ML2.13 supports ISM-0138 by preserving the integrity of log-derived evidence, but ISM-0138 extends beyond logs into investigator practices and legal defensibility.
This control supports ISM-1989.
ISM-1989 requires event logs to be retained for minimum periods as set out in AFDA Express. E8-AH-ML2.13 requires protecting event logs from unauthorised modification and deletion, which directly supports meeting retention obligations by preventing premature loss or tampering. ISM-1989 sets the retention requirement, while E8-AH-ML2.13 addresses the security controls needed to keep logs trustworthy and available during that retention window.
This control depends on ISM-1509.
ISM-1509 requires privileged access events to be centrally logged so they can be monitored and relied upon during investigations. E8-AH-ML2.13 requires protecting event logs from unauthorised modification and deletion, which is essential to ensure centrally collected privileged logs remain trustworthy. Without log integrity protections, the effectiveness of ISM-1509 is materially reduced.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.1Encrypt event logs and restrict access to prevent tampering and deletionPartially overlaps
This control partially overlaps IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including by encryption; E8-AH-ML2.13 (user application hardening) requires event logs to be protected from unauthorised modification and deletion, a subset of that.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingPartially overlaps
This control partially overlaps IT.DET-01.3.
IT.DET-01.3 requires a centralised event log store that protects logs from unauthorised access or modification; E8-AH-ML2.13 (user application hardening) requires event logs to be protected from unauthorised modification and deletion, overlapping on modification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.