ASD ISM 1566 Central logging of unprivileged system access
What it says
Use of unprivileged access is centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystem logs keep track of unprivileged user actions to monitor access and security.
This control is about recording the actions of users who do not have special privileges on your systems. It helps keep track of who accessed what and when, which is crucial for detecting and responding to any unauthorised actions. Without this, you might miss signs of improper access, potentially leading to data breaches or system abuse.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of unprivileged access, unauthorised actions may go undetected, risking data breaches and compromising system integrity.
How to implement
IT team should set up central logging: Gather system logs from all devices and software that are accessed by unprivileged users.
This can be done using centralised logging software that compiles all these logs in one place.
System administrator needs to define what actions are logged: Work out what specific user activities should trigger a log entry.
Focus on actions like logins, file access, and system changes, ensuring these are captured accurately.
IT team should regularly review logs: Appoint someone to routinely check these logs for any unusual or suspicious activity.
Set up automated alerts for certain patterns that indicate potential issues.
Management should ensure all staff are aware: Conduct training sessions to explain that logging is active and why it's important.
Make sure everyone knows their actions can be viewed if needed for security reasons.
IT support should maintain the logging system: Schedule maintenance checks to ensure the logging system is functioning correctly and logs are being saved over time.
Address any technical issues that could prevent proper recording.
Keep it running
Ensure logs for unprivileged access are reviewed weekly, as patterns may reveal misuse or anomalies that require timely investigation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The log retention policy: Request documentation that details how long logs are kept and how they are stored.
Look at
Whether the practices align with security standards, like those recommended by the Australian Cyber Security Centre (ACSC).
Good evidence
Shows defined periods and secure storage methods.
- Check 2 of 5What an auditor asks for
Ask for
To see recent logs: Request access to the system's centralised log repository.
Look at
User actions that are properly documented with time stamps and sources.
Good evidence
Shows logs with clear entries for user activities and any anomalies flagged.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of log review: Request a record of log reviews, like meeting notes or a log review schedule.
Look at
Evidence of regular checks and identified issues being addressed.
Good evidence
Includes multiple past reviews with follow-up actions taken.
- Check 4 of 5What an auditor asks for
Ask for
Training materials: Request any resources or documentation on user training regarding logging practices.
Look at
How clearly it's communicated to staff and whether it highlights the importance of logging.
Good evidence
Includes slides or handouts used during training sessions.
- Check 5 of 5What an auditor asks for
Ask for
System maintenance records: Request logs of maintenance checks on the logging system.
Look at
Frequency and outcomes of each check to ensure the system's health.
Good evidence
Would show regular maintenance with resolved issues documented.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
ISM-1566 requires that use of unprivileged access is centrally logged to provide visibility of non-admin user activity. ISO/IEC 27001:2022 Annex A 8.15 requires organisations to produce, store, protect and analyse logs of relevant activities and events, which includes (but is not limited to) unprivileged access logging. Annex A 8.15 is broader because it covers many event types plus log protection and analysis, whereas ISM-1566 is specifically about central logging of unprivileged access.
This control supports A.8.16.
ISM-1566 requires that use of unprivileged access is centrally logged so user activity can be monitored and investigated. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents, which relies on high-quality centralised event visibility. ISM-1566 supports Annex A 8.16 by ensuring a key telemetry source (unprivileged user activity) is available for anomaly detection, even though Annex A 8.16 also encompasses broader monitoring methods beyond logging.
This control depends on A.5.28.
ISM-1566 requires central logging of unprivileged access to create an auditable record of user actions. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identifying, collecting, acquiring and preserving evidence related to information security events. ISM-1566 supports Annex A 5.28 because centralised unprivileged-access logs are a primary evidence source that those procedures can preserve and present.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-05.3Log every administrative and management change with user, timestamp and targetPartially overlaps
This control partially overlaps IT.PRO-05.3.
IT.PRO-05.3 requires every administrative change to systems, configurations or controls to be recorded with the user, timestamp and target; ISM-1566 requires use of unprivileged access to be centrally logged, complementing it by logging unprivileged rather than administrative activity.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.