Essential Eight RA-ML2.6 Privileged access events are centrally logged.
What it says
Privileged access events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep logs of admin actions in a central place to monitor for misuse.
Keeping track of what actions administrators take on computer systems is crucial. It's like having a CCTV system for your computer network. Without these records, if someone misuses their high-level access, it would be difficult to catch them or understand what went wrong.
Free. Save your status, tasks and notes.
Why it matters
Lack of central logs for privileged access can obscure unauthorised activities, risking undetected insider threats and hindering incident investigation.
How to implement
IT team should set up a central logging system to collect all admin activities by configuring the network to send logs to a secure server.
System administrators should ensure that all systems are configured to log privileged actions, like changes to system settings, by using the system's built-in logging features.
Security officers should regularly review these central logs to spot any unusual activities that might indicate misuse, by setting up a schedule for log analysis.
The IT manager should implement alerts for any known risky activities, such as failed login attempts or changes outside of business hours, by configuring the logging system's alerting functions.
Keep it running
Forward privileged access logs to a central SIEM, monitor them continuously, and alert on unusual admin actions to enable timely detection and investigation.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How are privileged access events logged in your organisation?
Look at
Review the configuration settings of the central logging system and examine the logs for recent privileged access events.
Good evidence
The system should automatically log all privileged access events and send them to a secure, central logging system which is regularly reviewed.
- Check 2 of 2What an auditor asks for
Ask for
Who regularly checks the central logs for unusual activities?
Look at
Check the audit logs of log reviews and any incidents or findings reported during the review process.
Good evidence
There should be a clear schedule of log reviews, and any findings should be documented and acted upon.
Mappings
Closest match in ASD Information Security Manual: ISM-1509, Log privileged access events centrally for monitoring, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-RA-ML2.6 requires privileged access events to be centrally logged to enable monitoring and investigation of administrative misuse. ISO/IEC 27001:2022 Annex A 8.15 requires logs for activities and events to be produced, stored, protected and analysed, which includes privileged actions as part of a broader logging regime. E8-RA-ML2.6 is a specific focus area within the wider logging requirements of Annex A 8.15, and it adds the explicit emphasis on privileged access and centralisation.
This control supports A.8.16.
E8-RA-ML2.6 requires privileged access events to be centrally logged to allow oversight and detection of misuse. Annex A 8.16 focuses on monitoring networks, systems and applications for anomalous behaviour and taking appropriate action. Centralised privileged-access logs produced under E8-RA-ML2.6 directly strengthen Annex A 8.16 by providing high-value telemetry for anomaly detection and incident evaluation, even though Annex A 8.16 is broader than privileged access alone.
ASD Information Security Manual: 14 mappings
This control is equivalent to ISM-1509.
E8-RA-ML2.6 requires that privileged access events are centrally logged so privileged activity can be monitored for misuse. ISM-1509 states the same requirement (privileged access events are centrally logged), matching both the intent and the implementation outcome. Both controls focus on central collection of privileged access logging rather than broader logging policy or review processes.
This control is broader than ISM-1613.
E8-RA-ML2.6 requires organisations to centrally log privileged access events to support detection of misuse. ISM-1613 requires that use of break glass accounts is centrally logged, which is a specific type of privileged access event. ISM-1613 therefore implements a narrower, high-risk subset of what E8-RA-ML2.6 is seeking across all privileged access pathways.
This control partially meets ISM-1650.
E8-RA-ML2.6 requires central logging of privileged access events across the environment to enable monitoring for misuse. ISM-1650 specifically mandates central logging for privileged user account and security group management events, which are a subset of privileged access activity. As a result, ISM-1650 covers only one important class of privileged events, while E8-RA-ML2.6 expects central logging for privileged access events more generally.
This control partially meets ISM-1830.
ISM-1830 requires security-relevant events for Microsoft AD DS domain controllers, AD CS CA servers, AD FS servers and Microsoft Entra Connect servers to be centrally logged. E8-RA-ML2.6 requires privileged access events to be centrally logged, which is a broader event category that would include privileged actions occurring on AD servers as well as on other systems. ISM-1830 is more technology-specific (Microsoft identity infrastructure) but does not limit itself only to privileged access events.
This control partially overlaps ISM-0582.
ISM-0582 requires that security-relevant events for Microsoft Windows operating systems are centrally logged. E8-RA-ML2.6 relates by requiring privileged access events (which include Windows security logs such as logon, privilege use and account management) to be centrally collected. ISM-0582 is broader in Windows event coverage, while E8-RA-ML2.6 is narrower and focused specifically on privileged access telemetry.
This control partially overlaps ISM-0585.
ISM-0585 requires consistent per-event fields such as who/what initiated an action, when it occurred, and which system and object were involved. ASD Essential Eight E8-RA-ML2.6 requires privileged access events to be centrally logged, which overlaps because those privileged events still need the attribution and time details ISM-0585 mandates. E8-RA-ML2.6 is narrower on event scope (privileged activity) and adds centralisation, while ISM-0585 is a general log-content requirement across event types.
This control partially overlaps ISM-1537.
ISM-1537 requires organisations to centrally log security-relevant database events, including privileged user activity such as DBA actions and privilege elevation attempts. E8-RA-ML2.6 requires privileged access events to be centrally logged across environments. They overlap on privileged activity logging, but ISM-1537 is database-specific and also includes non-privileged database events (e.g. structure changes, query patterns, alerts/failures) that E8-RA-ML2.6 does not specify.
This control partially overlaps ISM-1607.
ISM-1607 mandates integrity monitoring and centralised event logging for isolation mechanisms and host OS on shared servers. E8-RA-ML2.6 requires logging privileged access events, relevant as a key part of the telemetry ISM-1607 seeks to capture. The scope of ISM-1607 includes integrity and platform logs for shared environments specifically.
This control partially overlaps ISM-1895.
ISM-1895 requires central logging of successful and unsuccessful single-factor authentication events. E8-RA-ML2.6 focuses on centrally logging privileged access events, which can include privileged logons and session elevation activities. The controls overlap where privileged access is granted via single-factor authentication and those authentication outcomes are part of privileged access logging, but E8-RA-ML2.6 is broader in covering privileged activity beyond authentication outcomes.
This control partially overlaps ISM-1976.
ISM-1976 requires central logging of security-relevant events on macOS endpoints. E8-RA-ML2.6 specifically requires privileged access events to be centrally logged, which are typically part of the macOS security-relevant event set (e.g., elevation and administrative access). ISM-1976 is broader across event types on macOS, while E8-RA-ML2.6 is more focused on a particular access-related event class.
This control partially overlaps ISM-1977.
E8-RA-ML2.6 requires privileged access events to be centrally logged to detect and investigate misuse of elevated access. ISM-1977 requires central logging of security-relevant events for Linux operating systems, which may include privileged authentication and administrative actions. They overlap on centralising logs that may capture privileged activity, but ISM-1977 is OS-scoped and broader in event types, while E8-RA-ML2.6 is specifically about privileged access events across platforms.
This control partially overlaps ISM-1983.
ISM-1983 requires event logs to be sent to a centralised event logging facility as soon as possible after they occur. E8-RA-ML2.6 specifically requires privileged access events to be centrally logged, and timely centralisation per ISM-1983 strengthens the completeness and integrity of those privileged event records for detection and forensics. E8-RA-ML2.6 is narrower (privileged access events only) and does not explicitly require the 'as soon as possible' forwarding expectation in ISM-1983.
This control partially overlaps ISM-1989.
ISM-1989 requires event logs to be retained according to AFDA Express minimum retention requirements. E8-RA-ML2.6 requires privileged access events to be centrally logged, creating a specific class of security log records that then need to be retained. The overlap is that both concern security event logs as organisational records, but E8-RA-ML2.6 is about capturing/centralising privileged events whereas ISM-1989 is about how long any captured logs must be kept.
This control supports ISM-0580.
E8-RA-ML2.6 requires privileged access events to be centrally logged as an operational control to enable monitoring and detection. ISM-0580 requires an event logging policy to be developed, implemented and maintained, which provides governance and standardisation for how central logging (including privileged events) is defined, configured and managed. ISM-0580 is policy-focused and broader than privileged access, but it supports consistent implementation and assurance of E8-RA-ML2.6 across the organisation.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs from infrastructure, operating systems and applications to be forwarded to central log storage; E8-RA-ML2.6 requires privileged access events to be centrally logged, one specific type of security-relevant log.
- IT.PRO-05.3Log every administrative and management change with user, timestamp and targetPartially overlaps
This control partially overlaps IT.PRO-05.3.
IT.PRO-05.3 requires every administrative change to systems, configurations or controls to be recorded with the user, timestamp and target; E8-RA-ML2.6 requires privileged access events to be centrally logged, overlapping on recording administrative activity.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.