ASD ISM 1613 Central logging of break glass account usage
What it says
Use of break glass accounts is centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLogging is used to track and monitor the use of emergency access accounts.
This control is about keeping track of when and how emergency access accounts, also known as 'break glass accounts', are used. This is important because these accounts have high-level access to your systems, which, if misused, could lead to serious security breaches or data loss.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of break glass account use, misuse may go undetected, delaying incident response and enabling data breaches and unauthorised changes.
How to implement
IT team should establish a logging system: Set up a centralised logging mechanism that records any use of emergency access accounts.
Use accessible tools like a logging service that captures each login attempt and the actions taken.
System administrators should notify staff: Ensure that any employees who might need to use these accounts understand that their actions will be logged.
Provide training that highlights the importance of this control in protecting the organisation.
Managers should ensure documentation: Confirm that all use of break glass accounts is documented with justifications for access.
Ensure that these documents are stored securely and made available for review when needed.
Executives should establish clear policies: Develop policies that outline when and how break glass accounts are to be used in emergencies.
Ensure that these policies are communicated across the entire business.
Keep it running
Centrally log all break glass use to the SIEM; alert on use, capture timestamp, account, source and actions, and review records after each event.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Access logs: Request the central log files or reports that record when break glass accounts were accessed.
Look at
The timestamps and actions recorded to ensure all instances are logged properly.
Good evidence
Is a well-organised log showing regular entries with no unexplained gaps.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request documentation of staff training sessions that include break glass account use.
Look at
The attendance records and training material provided. Good evidence includes signed attendance sheets and slides showing policy details.
- Check 3 of 5What an auditor asks for
Ask for
Policy documents: Request to see the policies surrounding emergency access account use. Examine how detailed these policies are and whether they cover key aspects like justification and review processes.
Good evidence
Policy is comprehensive and covers all necessary steps.
- Check 4 of 5What an auditor asks for
Ask for
Review records: Request records of the regular log reviews conducted by IT.
Look at
The frequency and findings of these reviews.
Good evidence
Is a detailed report noting any anomalies and actions taken.
- Check 5 of 5What an auditor asks for
Ask for
Documentation of access justifications: Request written justifications for each use of the break glass accounts.
Look at
These justifications for legitimate reasons aligned with policy criteria.
Good evidence
Is a clear, authorised document for each access event.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
ISM-1613 requires central logging specifically for break glass account usage. Annex A 8.15 requires organisations to produce, protect, store and analyse logs for activities and relevant events across systems. ISM-1613 is a specific, emergency-access-focused instance of the broader logging governance and coverage expected by Annex A 8.15.
ASD Essential Eight: 2 mappings
This control partially meets E8-RA-ML2.6.
E8-RA-ML2.6 requires organisations to centrally log privileged access events to support detection of misuse. ISM-1613 requires that use of break glass accounts is centrally logged, which is a specific type of privileged access event. ISM-1613 therefore implements a narrower, high-risk subset of what E8-RA-ML2.6 is seeking across all privileged access pathways.
- E8-RA-ML2.7Centrally log privileged user account and security group management eventsPartially overlaps
This control partially overlaps E8-RA-ML2.7.
ISM-1613 requires that use of break glass accounts is centrally logged. E8-RA-ML2.7 focuses on centrally logging privileged account and group management events (e.g. creation, deletion, group membership changes), which can be relevant to controlling and tracing break glass account enablement/permission changes. The overlap is partial because ISM-1613 is about logging account usage (logons/actions), while E8-RA-ML2.7 is about logging administrative management changes rather than use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.