Essential Eight RA-ML2.7 Centrally log privileged user account and security group management events
What it says
Privileged user account and security group management events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure logs of admin account and group changes are stored in one place.
Imagine all the important door keys in your business on one keychain. If you lose that keychain, someone could access everything. Similarly, if changes to your admin accounts aren't logged in one central place and someone gets into those accounts, it could mean trouble. Logging these changes helps you track and respond quickly to anything suspicious.
Free. Save your status, tasks and notes.
Why it matters
Without central logging, unauthorised privileged account or group changes can go undetected, enabling persistence, fraud or sabotage.
How to implement
The IT team should set up a central logging system.
Do this by configuring all servers and devices to send their logs of admin account and group changes to one secure location.
System administrators need to ensure logging is enabled on all systems.
Check that every system is configured to record changes to who has admin access.
Security officers should review the central logs regularly.
Schedule weekly checks to look for unusual changes or patterns in admin account activities.
The IT manager should implement access controls on the logging system.
Only authorised personnel should have access, ensuring the logs themselves are protected against tampering.
IT staff should back up logs regularly.
Create an automated system that backs up logs daily to prevent loss of data due to system failures.
Keep it running
Centrally collect admin account/group change events and alert on unexpected adds/removes to privileged groups and sudden privilege grants.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you ensure that all admin account changes are logged centrally?
Look at
Examine the configuration settings on your servers and devices for central logging.
Good evidence
All systems are set up to automatically send logs of admin changes to a secure, central logging solution.
- Check 2 of 2What an auditor asks for
Ask for
Who reviews the central logs and how often?
Look at
Check a log review schedule and any related reports or notes on actions taken.
Good evidence
The security officer reviews logs weekly, with documented notes on any anomalies and actions taken.
Mappings
Closest match in ASD Information Security Manual: ISM-1650, Log management of privileged user activities, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-RA-ML2.7 requires central logging of privileged account and group management events. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant activities and events, which is broader than privileged management changes alone and includes log protection and analysis expectations. E8-RA-ML2.7 is a specific logging use case within the wider logging control of Annex A 8.15.
This control depends on A.5.28.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identifying, collecting and preserving evidence related to security events, which is strengthened by having central, complete records of privileged identity and group changes. E8-RA-ML2.7 provides a key evidence source, while Annex A 5.28 focuses on the broader forensic process and handling requirements rather than what must be logged.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1650.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-1650 explicitly requires privileged user account and security group management events to be centrally logged, matching the same event types and centralisation requirement. Both controls focus on ensuring administrative identity and group changes are captured in a central logging capability for security monitoring and accountability.
This control partially meets ISM-1509.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-1509 requires privileged access events to be centrally logged, which is broader because it can include authentication, session use, command execution, and other privileged actions beyond just account/group management changes. E8-RA-ML2.7 is therefore a specific subset of ISM-1509 focused on administrative identity and group administration events.
This control partially overlaps ISM-0585.
E8-RA-ML2.7 requires central logging of privileged account and group management events. ISM-0585 requires that, for each event logged, key details such as timestamp, user/process, description and equipment involved are captured, improving the usefulness of those centrally collected privileged-management logs. E8-RA-ML2.7 focuses on ensuring the right privileged management events are centrally collected, while ISM-0585 focuses on the completeness and fields within any logged events.
This control partially overlaps ISM-1537.
E8-RA-ML2.7 requires central logging of privileged account and group management events. ISM-1537 requires central logging of security-relevant database events, including adding privileged users and changing roles/privileges, which can include privileged identity management within database platforms. ISM-1537 is database-specific and broader across many database event types, while E8-RA-ML2.7 is focused on privileged account/group management events across the environment.
This control partially overlaps ISM-1613.
ISM-1613 requires that use of break glass accounts is centrally logged. E8-RA-ML2.7 focuses on centrally logging privileged account and group management events (e.g. creation, deletion, group membership changes), which can be relevant to controlling and tracing break glass account enablement/permission changes. The overlap is partial because ISM-1613 is about logging account usage (logons/actions), while E8-RA-ML2.7 is about logging administrative management changes rather than use.
This control partially overlaps ISM-1976.
ISM-1976 requires central logging of security-relevant events on macOS systems. E8-RA-ML2.7 covers central logging of privileged account and group management events, which are a subset of security-relevant events that may occur on macOS (local accounts/groups or directory-integrated administration). ISM-1976 is broader across all macOS security events, while E8-RA-ML2.7 is narrower and focused on identity administration changes.
This control partially overlaps ISM-1977.
ISM-1977 requires security-relevant events for Linux operating systems to be centrally logged. E8-RA-ML2.7 requires central logging of privileged account and group management events, which on Linux include user/group changes and sudoers-related administration that are security-relevant. E8-RA-ML2.7 is focused on identity and group lifecycle events, whereas ISM-1977 is broader across Linux system event sources beyond account and group management.
This control depends on ISM-0580.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-0580 requires an event logging policy to be developed, implemented and maintained, which typically defines what privileged account and group management events must be captured and where they are sent. Without the policy control in ISM-0580, implementation of E8-RA-ML2.7 is more likely to be inconsistent or incomplete across systems.
This control depends on ISM-0988.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-0988 requires an accurate and consistent time source for event logging, which strengthens the evidentiary value and correlation of central logs for privileged account and group changes. ISM-0988 does not itself require central logging, but it materially improves the usefulness of E8-RA-ML2.7 for detection and investigations.
This control depends on ISM-1405.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-1405 requires an organisation to implement a centralised event logging facility, which is a foundational capability needed to centralise logs from identity and directory services. In practice, E8-RA-ML2.7 is difficult to implement consistently without first having the central logging facility mandated by ISM-1405.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes to be forwarded to central log storage; E8-RA-ML2.7 requires privileged user account and security group management events to be centrally logged, a specific case of that forwarding.
- IT.PRO-05.3Log every administrative and management change with user, timestamp and targetPartially overlaps
This control partially overlaps IT.PRO-05.3.
IT.PRO-05.3 requires every administrative change to systems, configurations or controls to be recorded with the user, timestamp and target; E8-RA-ML2.7 requires privileged user account and security group management events to be centrally logged, a specific case of those changes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.