ASD ISM 1985 Protect event logs from unauthorised access
What it says
Event logs are protected from unauthorised access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that only authorised individuals can view or access event logs.
Protecting event logs means keeping a close eye on who can see or change the digital records of what happens in your systems. If unauthorised people access these logs, they could cover up harmful activities or misuse sensitive information, leading to trust issues and potential harm to your business.
Free. Save your status, tasks and notes.
Why it matters
If event logs are not protected, attackers can alter or delete entries to hide activity, undermining investigations and causing reputational damage.
How to implement
System administrators should set up permissions to make sure only certain trusted staff can view or manage event logs.
Do this by using the system's built-in tools to create accounts with the right level of access, ensuring only those who need to see these logs can do so.
IT teams should encrypt event logs, which means coding them in a way that only permitted users can read or change the information.
Use encryption features provided in security software to ensure data is protected from prying eyes.
Business owners should invest in training so staff understand the importance of protecting event logs.
Organise regular training sessions to remind everyone of the risks and teach them how to handle logs safely.
Regularly audit or review the event logs access by asking an external consultant for an unbiased security check-up.
This can help spot any unauthorised access early and ensure that your systems are as safe as possible from potential threats.
Keep it running
Audit and restrict event log access (read/export/delete) to approved roles only, and regularly review permissions to detect and remove unauthorised access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The user access list: Request the list of all users who have permission to access event logs.
Look at
The list to verify that it includes only staff members who need this access for their jobs.
Good evidence
The list is up-to-date and matches current roles in the organisation.
- Check 2 of 5What an auditor asks for
Ask for
To see the log configuration settings: Search for evidence that only authorised staff have permissions to access these settings. Good evidence includes documentation showing explicitly who has been granted these permissions and why.
- Check 3 of 5What an auditor asks for
Ask for
The training records on log security: Review documents or certifications indicating staff have completed training.
Look at
Records of recent training sessions that cover the importance of log protections.
Good evidence
All relevant staff have current training records.
- Check 4 of 5What an auditor asks for
Ask for
The encryption status of event logs: Request documentation that proves logs are being encrypted.
Look at
Technical reports or screenshots that show encryption is set up as per policy.
Good evidence
Clear evidence that encryption is active and consistently applied.
- Check 5 of 5What an auditor asks for
Ask for
To review any recent security audits: Examine the results, particularly noting any findings about log security.
Look at
Recommendations made and actions taken to resolve issues.
Good evidence
Includes timely response actions and resolved security concerns.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.13, Protect event logs from unauthorised changes or deletion, which this control covers in full and more.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-1985 requires restricting who can access event logs to authorised individuals. Annex A 5.15 relates by requiring access control rules and procedures to be established and implemented across information assets, which would govern access to log repositories and log management systems. ISM-1985 is a specific, log-focused instance of the broader access control governance required by Annex A 5.15.
This control partially meets A.5.33.
Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. ISM-1985 requires event logs (records) to be protected from unauthorised access, aligning directly to the confidentiality aspect of record protection. Annex A 5.33 is broader because it covers many record types and additional threats such as destruction and falsification.
This control partially meets A.8.3.
ISM-1985 requires event logs to be protected from unauthorised access. Annex A 8.3 relates by requiring restriction of access to information and associated assets according to access control policy, which includes log data as an information asset. ISM-1985 is a specific application of this broader access restriction requirement to the particular asset class of event logs.
This control partially meets A.8.15.
ISM-1985 requires that event logs are protected from unauthorised access. Annex A 8.15 relates by requiring logs be produced, stored, protected and analysed, explicitly including protection of logs as part of a full logging lifecycle. ISM-1985 is narrower because it focuses specifically on preventing unauthorised access, whereas Annex A 8.15 also covers generation, retention/storage controls and analysis activities.
ASD Essential Eight: 3 mappings
This control is broader than E8-AH-ML2.13.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion. ISM-1985 focuses on protecting event logs from unauthorised access, which is related but does not necessarily prevent alteration or deletion by an authorised-but-malicious actor. Protecting access supports integrity, but E8-AH-ML2.13 is more specific about tamper/erase resistance.
This control partially overlaps E8-AC-ML2.6.
E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion, focusing on preventing tampering and removal. ISM-1985 requires event logs to be protected from unauthorised access, which overlaps through access controls that also help prevent unauthorised changes. However, ISM-1985 is primarily confidentiality-focused (read/access), while E8-AC-ML2.6 explicitly targets integrity/availability impacts (modify/delete).
This control partially overlaps E8-RA-ML2.8.
E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion. ISM-1985 requires event logs to be protected from unauthorised access, which overlaps where access controls also prevent unauthorised changes or deletions. However, E8-RA-ML2.8 is specifically about integrity and retention against tampering, while ISM-1985 is broader around confidentiality of logs (read access) and does not explicitly require anti-deletion/anti-modification measures.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-01.1Encrypt event logs and restrict access to prevent tampering and deletionPartially overlaps
This control partially overlaps IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including encryption and securing the systems and accounts that handle them; ISM-1985 requires event logs to be protected from unauthorised access, covering only the access part.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingPartially overlaps
This control partially overlaps IT.DET-01.3.
IT.DET-01.3 requires a centralised event log storage capability that protects logs from unauthorised access or modification; ISM-1985 requires event logs to be protected from unauthorised access, covering the access part of that protection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.