Privileged Activity Log Review Checklist

When to use this

Use this checklist to review privileged account activity logs for appropriate, authorized, and traceable use.

Related controls

• A.8.2 Privileged Access Rights
• Privileged Access Register

Review checklist

• Logs identify individual privileged user.
• Activity aligns to approved role or work order.
• Emergency access use is matched to emergency record.
• Failed privileged access attempts are reviewed.
• Log retention meets requirements.
• Logs are protected from modification.
• Suspicious activity is escalated.

Review record