ASD ISM 1650 Log management of privileged user activities
What it says
Privileged user account and security group management events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep track of changes to privileged user accounts by logging them in one central place.
This control is about keeping track of what people with special access to your computer systems are doing. It matters because if no one is watching over these activities, someone could make harmful changes without being noticed, leading to data being stolen or systems being compromised.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of privileged account and security group changes, malicious or unauthorised access and permission changes may go undetected, enabling persistent compromise.
How to implement
The IT team should set up a central log for all activities related to privileged accounts.
Use software that collects and stores logs in one secure place so actions by users with special access can be reviewed if needed.
System administrators should review the logs regularly.
This means checking the records every week to see if there is anything unusual, like unexpected changes or access at odd hours.
Managers should assign responsibility to someone for reviewing the privileged account logs.
They should choose a trusted team member and provide them with training to understand what to look for in the logs.
The IT department should regularly test the logging system to ensure it is capturing all necessary data.
Run tests every month to verify that logs are being recorded correctly and include crucial events like changes to user privileges.
The security officer should ensure that logs are kept secure and only accessible to authorised personnel.
Implement access controls so that only those who need to review the logs can see them, protecting them from tampering.
Keep it running
Ensure privileged account and security group management events are forwarded to a central log platform, protected from tampering, and routinely reviewed for unexpected membership or role changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The log management policy document: Request to see the written policy that describes how privileged user activities are logged.
Look at
Whether it specifies what activities are logged and how often they are reviewed.
Good evidence
Includes clear guidelines on logging frequency, scope, and responsibility assignments.
- Check 2 of 5What an auditor asks for
Ask for
To see a recent log review report: Check for a document that shows the results of a privileged account activity log review.
Look at
The detail of what was reviewed and any anomalies noted.
Good evidence
Shows logs were reviewed, issues were flagged, and appropriate follow-up actions were recorded.
- Check 3 of 5What an auditor asks for
Ask for
Who is responsible for log reviews: Request a list of personnel with their roles related to log management.
Look at
Whether each person's responsibilities are clearly defined.
Good evidence
Has named individuals with clear duties and contact information.
- Check 4 of 5What an auditor asks for
Ask for
Access control documentation for log files: Ask to see who has access to the logs and how that access is controlled.
Look at
A list of authorised users and evidence of access restrictions.
Good evidence
Demonstrates that only necessary personnel can access logs, reducing risk of tampering.
- Check 5 of 5What an auditor asks for
Ask for
To see any recorded incidents related to privileged activity: Request a report of any logged incidents involving misuse of privileged accounts.
Look at
How incidents were detected through logs and what actions were taken.
Good evidence
Shows timely detection through logs and a record of responsive actions taken.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.7, Centrally log privileged user account and security group management events, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control is broader than A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed, which typically includes accountability mechanisms around privileged operations. ISM-1650 relates by requiring central logging of privileged user account and security group management events to monitor and detect inappropriate privilege changes. ISM-1650 is focused on audit logging, while Annex A 8.2 is broader and includes authorisation, assignment, and restrictions on use.
This control partially meets A.8.15.
ISM-1650 requires central logging of privileged user account and security group management events. Annex A 8.15 is broader as it requires organisations to produce, store, protect and analyse logs for a wide range of activities and events, not limited to privileged identity management. ISM-1650 fits within Annex A 8.15 as a specific logging use case focused on privileged account and group changes.
This control supports A.8.16.
ISM-1650 requires central logging of privileged user account and security group management events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour, which is enabled by having high-value audit data such as privileged account and group changes captured centrally under ISM-1650. Annex A 8.16 is detection/monitoring oriented, while ISM-1650 is a specific logging requirement that feeds those monitoring activities.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-RA-ML2.7.
ISM-1650 requires privileged user account and security group management events to be centrally logged. E8-RA-ML2.7 specifies the same outcome by requiring privileged account and group management events to be centrally logged. The scope and intent align closely, focusing on central visibility of administrative changes to privileged identities and groups.
This control partially meets E8-RA-ML2.6.
ISM-1650 requires privileged user account and security group management events to be centrally logged. E8-RA-ML2.6 is broader because it covers privileged access events generally (e.g., elevated logons/use of admin rights), not just account and group management changes. ISM-1650 is therefore a specific subset focused on identity/group administration events rather than all privileged activity.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.