ASD ISM 2052 Ensure event logs protect sensitive data
What it says
Event logs produced by software ensure that any sensitive data is protected.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvent logs must keep sensitive information safe and secured.
Event logs are like a diary of your computer systems, keeping track of what happens over time. It's crucial to ensure these logs don't accidentally reveal private information. If sensitive data leaks through logs, it could be misused by hackers, leading to data breaches or identity theft.
Free. Save your status, tasks and notes.
Why it matters
If event logs expose sensitive data, attackers may use it to gain access or exfiltrate data, causing breaches, incident response costs and reputational damage.
How to implement
System administrators should work with software developers to regularly review the type of information recorded in event logs.
They can do this by setting up workshops where the team analyses logs to identify any sensitive data like user passwords or financial details appearing in them.
IT teams should configure logging software to automatically mask any sensitive information.
This can be done by setting rules within the logging software to replace sensitive data with general placeholders, like replacing credit card numbers with asterisks.
Managers should ensure that access to event logs is limited to authorised personnel only.
This means setting up permissions so that only certain people, trained in handling sensitive information, can view the full logs.
Cyber security officers should establish clear guidelines on what constitutes sensitive data.
They might organise a meeting to create a list of data types considered private, ensuring all team members understand what should be protected in logs.
IT teams should implement log review processes to regularly check logs for any sensitive data leaks.
This can involve setting up automated alerts to notify the team if sensitive data is detected in logs, prompting immediate action.
Keep it running
Audit logging to prevent secrets/PII in logs; mask or encrypt values and restrict log access to approved admins. Periodically test by reviewing sample log entries.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The event logging policy: Request the document outlining log management procedures.
Look at
Sections addressing data protection specifically and roles responsible for log reviews.
Good evidence
Clearly describes how sensitive information is protected and who oversees the process.
- Check 2 of 5What an auditor asks for
Ask for
A sample of redacted event logs: Review examples of logs that have been scrubbed of sensitive data.
Look at
Consistent masking of any private data like personal identifiers or financial information.
Good evidence
Shows logs where sensitive details are either absent or appropriately obscured.
- Check 3 of 5What an auditor asks for
Ask for
A list of personnel with log access: Obtain a document or system access list showing who can view logs.
Look at
The job roles and verify they align with those needing access for their duties.
Good evidence
Comprises a short list of authorised individuals tied to necessary functions.
- Check 4 of 5What an auditor asks for
Ask for
About training records for staff handling logs: Request documentation of training sessions on log management and data protection.
Look at
Training content that emphasises the importance of keeping logs secure.
Good evidence
Includes recent, relevant training records that are regularly updated.
- Check 5 of 5What an auditor asks for
Ask for
Examples of alerts set up for sensitive data leaks: Check configurations or reports that show alerts are active.
Look at
Details in the system setup that trigger alerts when specific types of data appear in logs.
Good evidence
Indicates that alerts are properly configured and documented.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
ISM-2052 requires that event logs produced by software protect any sensitive data contained within them. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, which includes protecting log content and the log repositories. ISM-2052 is more specific to safeguarding sensitive data in logs (e.g., preventing exposure of secrets/PII in log entries), while Annex A 8.15 is broader across the full logging lifecycle including analysis and operational handling.
This control partially overlaps A.8.12.
ISM-2052 requires that event logs produced by software protect any sensitive data contained within them. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention measures across systems, networks and devices that process, store or transmit sensitive information, which can include preventing sensitive data exfiltration via logs or log forwarding. ISM-2052 is specifically focused on the logging artefact and its contents, while Annex A 8.12 is broader and addresses leakage pathways beyond logging.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-AC-ML2.6.
ISM-2052 requires that event logs produced by software protect any sensitive data contained within them. ASD Essential Eight E8-AC-ML2.6 focuses on protecting event logs from unauthorised modification and deletion, which helps preserve the confidentiality and integrity of any sensitive data that appears in logs. ISM-2052 also covers protecting sensitive log content even when logs are not being altered (e.g., access controls, redaction, secure handling), which E8-AC-ML2.6 does not explicitly address.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.