ASD ISM 1815 Protect event logs from unauthorised access
What it says
Event logs are protected from unauthorised modification and deletion.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure logs are safe from changes or deletion by unauthorised users.
Event logs are records of what's happening in your computer systems. Protecting these logs from unauthorised changes or deletion is crucial because, if tampered with, it can hide intrusions or other malicious activities by masking suspicious behaviour.
Free. Save your status, tasks and notes.
Why it matters
If event logs can be modified or deleted, attackers can hide evidence of compromise, delaying detection and weakening investigations and response.
How to implement
The IT team should ensure that only authorised staff have access to event logs by using user accounts with limited permissions.
This can be done by setting up user roles and permissions specifically for log access in your system settings, ensuring only certain personnel can view or modify them.
System administrators should regularly check who has access to event logs and adjust permissions as needed.
Conduct audits and maintain a list of people with access, updating it whenever there are changes in staff or roles.
Managers should ensure there is a backup system for event logs.
This can be achieved by scheduling automatic backups every day and storing them securely, possibly offsite or on a specific server designated for backup purposes.
The IT security officer should implement an alert system for unauthorised access attempts.
This can be established by configuring notifications in the system that send alerts to the security team if anyone tries to access or modify the logs without permission.
HR and IT should work together to train all relevant staff on the importance of log security and the consequences of breaches.
Offer workshops or distribute information sheets explaining log security policies and the critical nature of protecting event logs.
Keep it running
Restrict log access to admins only, enable append-only/immutable storage where possible, and routinely check integrity (hashing/alerts) for changes or deletions.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
The last access control review documentation: Ensure this document lists who had access to the event logs and any adjustments made.
Look at
The list for completeness and timeliness of updates.
Good evidence
Is one where all current roles with log access are accounted for and align with staff responsibilities.
- Check 2 of 2What an auditor asks for
Look at
Records of training sessions about the importance of event log security that pertinent staff attended. Good evidence spans recent reviews with clear details on content and dates.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.6, Event logs are protected from unauthorised modification and deletion, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.33.
Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. ISM-1815 specifically requires protection of event logs (a type of record) from unauthorised modification and deletion, directly supporting integrity and availability of that record class. The ISO control is broader because it also covers other record types and additionally covers unauthorised access and release.
This control partially meets A.8.3.
ISM-1815 requires that event logs are protected from unauthorised modification and deletion. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which would include log data and log storage systems. ISM-1815 is a specific application of access restriction focused on log integrity, whereas Annex A 8.3 is broader across all information assets.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-AC-ML2.6.
ISM-1815 requires event logs to be protected from unauthorised modification and deletion. E8-AC-ML2.6 states the same requirement with the same intent and outcome for log integrity. Both focus on preventing unauthorised tampering or removal of logs rather than broader log collection or analysis activities.
This control is equivalent to E8-AH-ML2.13.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion to prevent tampering. ISM-1815 states the same requirement, explicitly mandating protection of event logs from unauthorised modification and deletion. Both controls have the same security outcome and scope (log integrity and availability against unauthorised change).
This control is equivalent to E8-MF-ML2.7.
ISM-1815 requires event logs to be protected from unauthorised modification and deletion. E8-MF-ML2.7 expresses the same control outcome by requiring protection of event logs from unauthorised changes. While worded slightly differently, both are implemented through controls like access restriction, immutability and protected central storage.
This control is equivalent to E8-RA-ML2.8.
ISM-1815 requires event logs to be protected from unauthorised modification and deletion. E8-RA-ML2.8 matches this by requiring protection of event logs from unauthorised changes and loss (including deletion). The controls are aligned on preserving log integrity and availability against unauthorised actions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.