Essential Eight RA-ML2.8 Event logs are protected from unauthorised changes and losses
What it says
Event logs are protected from unauthorised modification and deletion.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure event logs cannot be changed or deleted without authorisation.
Ensuring event logs are protected from unauthorised changes is crucial because these logs are like a diary of all the important activities and security events happening on your systems. If someone with bad intent changes or deletes these logs without permission, it covers up evidence of malicious activities, making it harder to spot and fix problems before they become bigger issues.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised log changes can conceal cyber intrusions, undermine forensic evidence, and delay threat detection, escalating organisational risk.
How to implement
The IT team should implement a logging solution that enforces permissions, so only authorised personnel can access and modify logs.
This can be achieved by setting up specific user roles and permissions that restrict log access.
The system administrator should configure log management tools to automatically detect and alert any attempts to alter or delete logs.
Implement logging tools that have built-in integrity checks and alerts.
The security officer should establish a routine for backing up event logs regularly.
Ensure backups are stored securely and cannot be tampered with.
System administrators should regularly audit and review event logs to identify any suspicious activities.
Use monitoring tools to flag unusual log-in attempts or activities.
The IT team should keep software for logging and monitoring up to date to protect against known vulnerabilities.
Schedule regular updates and patching routine for all logging systems.
Keep it running
Ensure logs have strict access controls and immutable storage; routinely monitor and alert on unauthorised attempts to alter or delete log data.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How are event logs protected from unauthorised access and changes?
Look at
Request policies that outline who can access and alter event logs.
Good evidence
Policies are in place that strictly define permissions for log access, along with automated alerts for unauthorised access attempts.
- Check 2 of 3What an auditor asks for
Ask for
How often are event logs backed up?
Look at
Check the backup logs and schedules for regular backups.
Good evidence
Event logs are backed up daily and stored securely, with access logs showing consistent scheduling.
- Check 3 of 3What an auditor asks for
Ask for
Are there any controls in place to monitor changes to event logs?
Look at
Examine the system configuration and alert settings in logging software.
Good evidence
The logging system has alert mechanisms for any unauthorised changes and generates regular reports of log integrity checks.
Mappings
Closest match in ASD Information Security Manual: ISM-1815, Protect event logs from unauthorised access, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.33.
E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion. Annex A 5.33 of ISO/IEC 27001:2022 requires records (a broader category that can include logs) to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. E8-RA-ML2.8 is a specific application of record protection focused on log integrity/availability rather than all organisational records and confidentiality aspects.
This control partially meets A.8.15.
E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity and availability. This relates directly to Annex A 8.15, which requires logs to be produced, stored, protected, and analysed, including protecting logs as part of an end-to-end logging capability. Annex A 8.15 is broader because it covers log generation and analysis as well as protection, while E8-RA-ML2.8 focuses specifically on preventing unauthorised changes and loss.
This control depends on A.5.28.
E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion to preserve trustworthy evidence of activity. Annex A 5.28 of ISO/IEC 27001:2022 requires procedures for identifying, collecting, acquiring and preserving evidence related to security events, which relies on logs being intact and tamper-resistant. E8-RA-ML2.8 supports Annex A 5.28 by ensuring log-derived evidence remains reliable, though Annex A 5.28 also covers broader evidence handling beyond logs.
ASD Information Security Manual: 3 mappings
This control is equivalent to ISM-1815.
ISM-1815 requires event logs to be protected from unauthorised modification and deletion. E8-RA-ML2.8 matches this by requiring protection of event logs from unauthorised changes and loss (including deletion). The controls are aligned on preserving log integrity and availability against unauthorised actions.
This control is broader than ISM-1624.
ISM-1624 requires PowerShell script block logs to be protected using Protected Event Logging functionality. E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion across the environment, which would encompass PowerShell logs as a subset. ISM-1624 is narrower because it specifies one log type and a particular protection approach rather than a general requirement for all event logs.
This control partially overlaps ISM-1985.
E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion. ISM-1985 requires event logs to be protected from unauthorised access, which overlaps where access controls also prevent unauthorised changes or deletions. However, E8-RA-ML2.8 is specifically about integrity and retention against tampering, while ISM-1985 is broader around confidentiality of logs (read access) and does not explicitly require anti-deletion/anti-modification measures.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.1Encrypt event logs and restrict access to prevent tampering and deletionPartially overlaps
This control partially overlaps IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including by encryption; E8-RA-ML2.8 (restrict administrative privileges) requires event logs to be protected from unauthorised modification and deletion, a subset of that.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingPartially overlaps
This control partially overlaps IT.DET-01.3.
IT.DET-01.3 requires a centralised event log store that protects logs from unauthorised access or modification; E8-RA-ML2.8 (restrict administrative privileges) requires event logs to be protected from unauthorised modification and deletion, overlapping on modification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.