Essential Eight AH-ML2.13Protect event logs from unauthorised changes or deletion
Official control statement
Event logs are protected from unauthorised modification and deletion.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure event logs cannot be tampered with or erased without permission.
What this means in practice
This control is about making sure that important computer records, known as event logs, can't be changed or erased without the right permissions. Without this protection, someone with bad intentions could hide their tracks after doing something harmful to a computer system.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
User application hardening
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML2
Why it matters
If event logs can be altered or deleted without detection, attackers can hide malicious activity, undermining forensic investigations and accountability for incidents.
Operational notes
Store logs on WORM or immutable storage and restrict log admin access; enable auditing/alerting on log changes to prevent unauthorised modification or deletion.
Implementation tips
- System administrators should ensure event logs are stored in a secure location. This can be done by configuring the system to save logs on a separate, protected server.
- The IT security team should set up access controls on the event log files. They can do this by restricting permissions so that only authorised personnel can make changes.
- System administrators should regularly back up event logs. Use automated backup tools to schedule and store backups safely.
- Security officers should implement log monitoring. Set up alerts for any changes to the logs, which can be achieved through monitoring software.
- The IT team should enable 'audit log integrity' features when available. This will add an extra layer of protection by ensuring log files are not tampered with.
Audit / evidence tips
- AskHow do you ensure the event logs are protected from unauthorised changes?
- Look atReview the access control settings for the event logs
- GoodAccess controls are in place, limiting changes to authorised personnel only
- AskHow do you make sure that event logs are regularly backed up?
- Look atCheck the schedule and location of log backups
- GoodAutomated backups are set up to occur nightly, stored securely
Cross-framework mappings
How E8-AH-ML2.13 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 5.33 | E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity for detection an... | |
| Annex A 8.15 | E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion | |
handshakeSupports(1)expand_less | ||
| Annex A 5.28 | E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion so they remain trustworthy | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-1815 | E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion to prevent tampering | |
layersPartially meets(2)expand_less | ||
| ISM-1624 | ISM-1624 requires PowerShell script block logs to be protected using Protected Event Logging functionality | |
| ISM-1985 | E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion | |
sync_altPartially overlaps(3)expand_less | ||
| ISM-0582 | ISM-0582 requires central logging of security-relevant events for Windows | |
| ISM-2125 | ISM-2125 requires that all service provider access to an organisation's systems is independently logged by the organisation in a tamper-r... | |
| ISM-2132 | ISM-2132 requires central logging of certificate enrolment activity and changes to certificate templates and AD CS configurations | |
handshakeSupports(2)expand_less | ||
| ISM-0138 | E8-AH-ML2.13 requires protecting event logs from unauthorised modification and deletion, helping ensure logs can be relied on during inci... | |
| ISM-1989 | ISM-1989 requires event logs to be retained for minimum periods as set out in AFDA Express | |
extensionDepends on(1)expand_less | ||
| ISM-1509 | ISM-1509 requires privileged access events to be centrally logged so they can be monitored and relied upon during investigations | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in User application hardening
See all User application hardening controls, or browse the full ASD Essential Eight library.