Australian Information Security Manual ISM-1509: Central logging of privileged access events

What else in your programme already covers this

This control maps to 8 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ACSC Essential Eight · 3 controls

E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)
E8-ADMIN-ML3 Restrict Administrative Privileges (ML3)
E8-ADMIN-ISM-1509 Restrict administrative privileges (ISM-1509): Privileged access events are centrally logged

New Zealand Information Security Manual (NZISM) · 3 controls

16.4.41.C.02 16.4.41.C.02 Privileged monitoring records user activity and anomalies
16.6.10.C.02 16.6.10.C.02 Minimum events logged for all software components
16.6.9.C.01 16.6.9.C.01 Minimum logged events on classified systems

ATO Digital Service Provider (DSP) Operational Security Framework · 1 control

SEC.AUDIT Audit logging of user access and actions, kept 12 months

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.