Essential Eight MF-ML2.7 Protect event logs from unauthorised changes
What it says
Event logs are protected from unauthorised modification and deletion.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure event logs cannot be changed or deleted without permission.
Protecting event logs from unauthorised changes is like keeping a secure diary of everything that happens on your computer systems. If someone can erase or change the logs, you may never know if something bad, like a cyber attack, happened. This control ensures you have a reliable record to look back on if something goes wrong.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised log changes can conceal security breaches, hindering forensic investigations and enabling ongoing attacks without detection.
How to implement
The IT team should ensure that event logs are stored in a secure location.
This can be done by configuring logs to be automatically copied or sent to a separate, secured server.
System administrators should set permissions so only authorised personnel can access or alter the event logs.
Use built-in tools like Group Policy settings to restrict access.
The security officer should regularly review access permissions to ensure they are up-to-date and only appropriate personnel have access.
The IT team should implement regular backups of event logs.
This can be done by scheduling automatic backups at specified intervals to avoid data loss.
System administrators should enable audit logging to track who accesses or modifies event logs.
This involves setting up monitoring systems to alert the team of any unauthorised access attempts.
Keep it running
Regularly audit event log integrity and alert on unauthorised modification or deletion attempts to maintain accountability and support investigations.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you ensure event logs cannot be changed without permission?
Look at
Review access control lists and permissions set on log directories.
Good evidence
Specific access permissions restrict log modifications to authorised IT personnel only.
- Check 2 of 2What an auditor asks for
Ask for
How is the integrity of event logs maintained over time?
Look at
Examine backup schedules and look for logs indicating successful backup completions.
Good evidence
Regular, automated backups occur and are logged, ensuring logs are preserved even if accidental deletions occur.
Mappings
Closest match in ASD Information Security Manual: ISM-1815, Protect event logs from unauthorised access, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
E8-MF-ML2.7 requires that event logs cannot be unauthorisedly modified or deleted, focusing on log integrity protections. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes integrity protections as one aspect of overall logging management. E8-MF-ML2.7 is therefore a more specific subset of Annex A 8.15, which also covers log creation and analysis activities.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1815.
E8-MF-ML2.7 requires that event logs are protected from unauthorised modification and deletion. ISM-1815 states the same requirement that event logs are protected from unauthorised modification and deletion, aligning in scope and intent. Implementing ISM-1815 would largely satisfy E8-MF-ML2.7 for protecting log integrity against tampering and removal.
This control partially overlaps ISM-1624.
E8-MF-ML2.7 requires event logs to be protected from unauthorised modification and deletion. ISM-1624 strengthens this outcome for a specific log source by requiring PowerShell script block logs to be protected using Protected Event Logging, reducing opportunities for attackers to tamper with that telemetry. ISM-1624 is narrower (PowerShell-specific) and does not, by itself, address protection of all event logs across the environment.
- ISM-1830Central logging of security events for Microsoft AD infrastructure serversPartially overlaps
This control partially overlaps ISM-1830.
ISM-1830 requires security-relevant events for Microsoft AD DS, AD CS, AD FS and Entra Connect servers to be centrally logged. E8-MF-ML2.7 requires event logs to be protected from unauthorised modification and deletion, which applies to logs generally, including centralised logs collected from AD servers. ISM-1830 is about ensuring the right AD server event sources are centrally collected, while E8-MF-ML2.7 is about integrity/retention protection regardless of source.
This control supports ISM-0580.
E8-MF-ML2.7 requires event logs to be protected from unauthorised modification and deletion through appropriate technical and administrative controls. ISM-0580 requires an event logging policy to be developed and maintained, which can mandate and govern protections such as access restrictions, retention, and tamper-evident storage. ISM-0580 is policy/process oriented, while E8-MF-ML2.7 is a specific security outcome focused on log integrity controls.
This control depends on ISM-1607.
ISM-1607 requires monitoring and central logging for shared servers using software isolation. E8-MF-ML2.7 ensures logs are protected from tampering, essential for the reliability of ISM-1607's monitoring data.
This control depends on ISM-1989.
ISM-1989 requires retention of event logs in line with AFDA Express minimum retention requirements. E8-MF-ML2.7 requires event logs to be protected from unauthorised modification and deletion, which supports ensuring logs remain intact and available for the full mandated retention period. ISM-1989 defines the retention obligation, while E8-MF-ML2.7 provides a key safeguard to achieve it.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.1Encrypt event logs and restrict access to prevent tampering and deletionPartially overlaps
This control partially overlaps IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including by encryption; E8-MF-ML2.7 (multi-factor authentication) requires event logs to be protected from unauthorised modification and deletion, a subset of that.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingPartially overlaps
This control partially overlaps IT.DET-01.3.
IT.DET-01.3 requires a centralised event log store that protects logs from unauthorised access or modification; E8-MF-ML2.7 (multi-factor authentication) requires event logs to be protected from unauthorised modification and deletion, overlapping on modification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.