ASD ISM 1509 Log privileged access events centrally for monitoring
What it says
Privileged access events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep records of high-level system access in one place to monitor and respond to potential issues.
Logging privileged access events means keeping a central record every time someone uses high-level permissions to access important systems. This is crucial because if something goes wrong, like sensitive data being leaked or a system being tampered with, you'll know who had special access and can quickly investigate.
Free. Save your status, tasks and notes.
Why it matters
Without centralised logging of privileged access events, misuse may go undetected, delaying response and enabling breaches or system compromise.
How to implement
IT team should establish central logging: They should set up a system to automatically record privileged access events.
This can be done by configuring programs that track who accessed systems and when, then storing these logs securely.
System administrators should define what privileged access means: They should list which roles or actions count as 'privileged' so everyone knows what needs to be logged.
This involves writing down specific access levels or accounts that have greater permissions than regular users.
Managers should train staff on logging importance: Managers must educate their team about why logging privileged access is essential.
This could be achieved through meetings or training sessions that explain the potential risks of not doing it.
IT security staff should regularly review access logs: They should look through the logs frequently to spot any unusual or unauthorised access.
This involves checking the records against expected access patterns and investigating any discrepancies.
Organisation leaders should ensure that logging follows ACSC guidelines: They should verify that the logging setup adheres to the Australian Cyber Security Centre's standards by consulting the guidelines and possibly engaging an external review.
Keep it running
Forward privileged access events to a central log platform (e.g., SIEM), validate time sync, and alert on privileged logons and admin actions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The privileged access log policy: Request documentation that outlines the process for logging privileged access and who is responsible for it.
Look at
Whether the policy clearly defines 'privileged access' and the frequency of log reviews.
Good evidence
Is a comprehensive policy that names responsible roles and specifies logging procedures.
- Check 2 of 5What an auditor asks for
Ask for
Recent access logs: Obtain samples of privileged access logs from the last 30 days.
Look at
Whether these logs actually capture details about who accessed what system at what time.
Good evidence
Is detailed logs that are easy to cross-reference with known access activities.
- Check 3 of 5What an auditor asks for
Ask for
Records of log reviews: Request evidence that logs are regularly reviewed by the IT security team.
Look at
Whether there are logs of these reviews, who conducted them, and what actions were taken.
Good evidence
Is documentation showing regular reviews and follow-up on any anomalies.
- Check 4 of 5What an auditor asks for
Ask for
Training records on logging procedures: Request proof that staff have been trained on the importance of logging privileged access.
Look at
Signed attendance sheets or training completion certificates.
Good evidence
Is dated records of training sessions with evidence of participation.
- Check 5 of 5What an auditor asks for
Ask for
A compliance check report: Request a report or external review that shows compliance with ACSC guidelines on privileged access logging.
Look at
Whether the review identifies any gaps or confirms adherence to best practices.
Good evidence
Is a report validating that the logging process meets national standards.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.6, Privileged access events are centrally logged., which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-1509 requires that privileged access events are centrally logged to support monitoring and response. ISO/IEC 27001:2022 Annex A 8.15 requires producing, storing, protecting and analysing logs of relevant activities and events across the organisation. ISM-1509 is a specific subset focused on centralising logs for privileged access events, whereas Annex A 8.15 is broader in both scope and lifecycle.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-RA-ML2.6.
E8-RA-ML2.6 requires that privileged access events are centrally logged so privileged activity can be monitored for misuse. ISM-1509 states the same requirement (privileged access events are centrally logged), matching both the intent and the implementation outcome. Both controls focus on central collection of privileged access logging rather than broader logging policy or review processes.
This control is broader than E8-RA-ML2.7.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-1509 requires privileged access events to be centrally logged, which is broader because it can include authentication, session use, command execution, and other privileged actions beyond just account/group management changes. E8-RA-ML2.7 is therefore a specific subset of ISM-1509 focused on administrative identity and group administration events.
This control partially overlaps E8-MF-ML2.6.
E8-MF-ML2.6 requires that successful and unsuccessful MFA events are centrally logged. ISM-1509 requires that privileged access events are centrally logged, which can include privileged authentications that may use MFA and therefore generate overlapping log content. ISM-1509 is centred on privilege use regardless of authentication method, while E8-MF-ML2.6 is centred on MFA outcomes for any account type (privileged or unprivileged).
This control supports E8-AH-ML2.13.
ISM-1509 requires privileged access events to be centrally logged so they can be monitored and relied upon during investigations. E8-AH-ML2.13 requires protecting event logs from unauthorised modification and deletion, which is essential to ensure centrally collected privileged logs remain trustworthy. Without log integrity protections, the effectiveness of ISM-1509 is materially reduced.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.