Essential Eight MF-ML2.6 MFA success and failure events are centrally logged
What it says
Successful and unsuccessful multi-factor authentication events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all successful and failed MFA attempts are logged in one central location.
This control is about keeping track of who is trying to get into your systems by logging all successful and unsuccessful attempts to use additional security checks, like codes sent to phones, to access accounts. Without it, a hacker could try many times to break in without anyone noticing, making it easier for them to access sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If MFA success and failure events aren't centrally logged, MFA abuse and credential-stuffing activity may be missed, delaying detection and response to account compromise.
How to implement
The IT team should ensure that all systems requiring multi-factor authentication are capable of sending authentication attempts to a central logging system by configuring the correct logging settings on each system.
A security officer should verify that all logs from multi-factor authentication are routinely being received and stored in a secure, central location, such as a dedicated server or cloud-based log management service, by monitoring the logging system regularly.
System administrators should configure alerts within the central logging system to notify them of repeated failed authentication attempts, which may indicate a potential security threat, by setting up specific thresholds for alerts.
The finance manager should ensure that there is a budget allocated for purchasing or subscribing to a reliable log management solution that can handle the volume of data produced by multi-factor logging.
The security team should regularly review and update log retention policies to ensure that logs are kept for a sufficient period of time to support any investigations into security incidents by consulting compliance requirements or industry best practices.
Keep it running
Ensure all MFA providers forward success/failure events to a central SIEM, retain logs, and alert on repeated failures, impossible travel, or MFA fatigue prompts across multiple accounts.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you describe your process for logging multi-factor authentication events?
Look at
Examine the central logging system to check for records of multi-factor authentication events, both successful and unsuccessful.
Good evidence
The organisation has a dedicated log management system that records every multi-factor attempt, with logs stored securely and accessible for audit purposes.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure that failed multi-factor authentication attempts are monitored and addressed?
Look at
Check the alerting mechanisms in place for failed authentication attempts in logs.
Good evidence
Alerts are configured to notify the security team about suspicious patterns of failed authentication attempts, which are investigated promptly.
Mappings
Closest match in ASD Information Security Manual: ISM-1683, Central logging of multi-factor authentication events, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
E8-MF-ML2.6 requires organisations to centrally log successful and unsuccessful MFA events. Annex A 8.15 requires producing, storing, protecting and analysing logs for activities, exceptions, faults and other relevant events, which would include authentication events such as MFA outcomes. E8-MF-ML2.6 is a specific logging use case (MFA success/failure central logging) within the broader ISO logging control.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-1683.
E8-MF-ML2.6 requires organisations to centrally log successful and unsuccessful multi-factor authentication (MFA) events. ISM-1683 states the same requirement for centrally logging both successful and unsuccessful MFA events. The scope and intent align closely (MFA outcomes and centralisation of logs), so implementing either would largely satisfy the other.
This control partially meets ISM-1405.
ISM-1405 requires a centralised event logging facility so authentication and other security-relevant logs can be collected in one location. E8-MF-ML2.6 directly relates by requiring MFA success and failure events to be centrally logged. The candidate is narrower as it addresses only MFA outcomes, while ISM-1405 is about centralising event logs across the environment.
This control partially overlaps ISM-0585.
ISM-0585 requires logs to capture date/time and the relevant user or process, plus descriptive and asset context for each event. ASD Essential Eight E8-MF-ML2.6 requires successful and unsuccessful multi-factor authentication events to be centrally logged, which overlaps because MFA events must record the actor and timestamp to support investigation. E8-MF-ML2.6 is specific to MFA and mandates central logging, while ISM-0585 applies to all logged events and focuses on the minimum fields within each record.
This control partially overlaps ISM-1509.
E8-MF-ML2.6 requires that successful and unsuccessful MFA events are centrally logged. ISM-1509 requires that privileged access events are centrally logged, which can include privileged authentications that may use MFA and therefore generate overlapping log content. ISM-1509 is centred on privilege use regardless of authentication method, while E8-MF-ML2.6 is centred on MFA outcomes for any account type (privileged or unprivileged).
This control partially overlaps ISM-1895.
ISM-1895 requires successful and unsuccessful single-factor authentication events to be centrally logged. E8-MF-ML2.6 requires the same central logging outcome but specifically for multi-factor authentication success and failure events. They overlap on the intent and logging pattern (central capture of auth outcomes), but differ in scope because ISM-1895 is about single-factor authentication while E8-MF-ML2.6 is about MFA.
This control partially overlaps ISM-1976.
ISM-1976 requires central logging of security-relevant events on macOS systems. E8-MF-ML2.6 relates by requiring successful and unsuccessful MFA events to be centrally logged, which may include authentication events generated by macOS-integrated identity services. ISM-1976 is broader and OS-scoped, whereas E8-MF-ML2.6 is narrower and event-category specific (MFA) regardless of operating system.
This control partially overlaps ISM-1977.
ISM-1977 requires security-relevant events for Linux operating systems to be centrally logged. E8-MF-ML2.6 requires central logging of MFA success and failure events, which may be generated by Linux-based authentication components (e.g. PAM modules) or upstream identity providers feeding Linux access decisions. E8-MF-ML2.6 is limited to MFA outcomes and is not Linux-specific, while ISM-1977 covers Linux system events more broadly and may include many non-MFA security logs.
This control supports ISM-0580.
E8-MF-ML2.6 requires central logging of MFA success and failure events. ISM-0580 requires an event logging policy to be developed, implemented and maintained, which typically defines what authentication events must be captured, where they are sent, and how they are retained and reviewed. The policy underpins consistent implementation of E8-MF-ML2.6, but E8-MF-ML2.6 is more specific to MFA event capture than ISM-0580's governance focus.
This control depends on ISM-1504.
ISM-1504 requires MFA to be used for authenticating users to online services handling sensitive data. E8-MF-ML2.6 requires central logging of successful and unsuccessful MFA events, which supports ISM-1504 by enabling monitoring, detection of attacks (e.g., MFA fatigue, brute forcing), and auditability of MFA enforcement. ISM-1504 does not address logging, so the candidate strengthens operational assurance rather than duplicating the core MFA requirement.
This control depends on ISM-1505.
ISM-1505 requires MFA to reduce unauthorised access. E8-MF-ML2.6 requires central logging of MFA events, supporting ISM-1505 by enabling monitoring and investigation of suspicious access attempts.
This control depends on ISM-1892.
ISM-1892 requires MFA to protect access to online customer services handling sensitive customer data. E8-MF-ML2.6 requires central logging of successful and unsuccessful MFA events, which strengthens monitoring and detection around the MFA mandated by ISM-1892. Logging is complementary: it does not replace the MFA requirement, but it improves assurance and incident response capability for those authentication events.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs to be forwarded to central log storage; E8-MF-ML2.6 requires successful and unsuccessful multi-factor authentication events to be centrally logged, a specific case of that forwarding.
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; E8-MF-ML2.6 requires central logging of successful and unsuccessful multi-factor authentication events, which helps detect anomalous authentication.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.