Attribute every action
Verify durable actor, tenant, endpoint, action, timestamp, parameters, and outcome fields across console, API, agent, job, alert, and remote-session activity.
24 audit controls · 15 fields · Public CSV · No signup
RMM audit log review checklist: 24 controls to test
An RMM audit log review should prove who acted, in which tenant, against which endpoint, when the action occurred, what changed, and whether it succeeded. Use this checklist to test that evidence across remote access, scripts, patching, identity changes, API activity, retention, export, monitoring, and investigations.
Download the CSVReview RMM scripting and automationPlan auditable RMM operations for insurance-agency ITRead the RMM security guideOpen the broader security registerReview technician accessUse the incident runbookSchedule recurring reviews
Test privileged workflows
Trace scripts, automation, patching, remote access, identity administration, credentials, integrations, configuration changes, denials, and alert lifecycle events.
Prove evidence integrity
Review immutability, retention, export completeness, search and pagination behavior, stable identifiers, delivery health, and high-risk event routing.
Make review operational
Assign cadence and ownership, correlate events across systems, record missing coverage as time-bounded exceptions, and retest remediation before closure.
RMM audit log review questions
What should an RMM audit log contain?
An RMM audit log should identify the actor, customer or tenant, endpoint or target, timestamp and timezone, action, relevant parameters, authorization context, outcome, and a durable event identifier. Test console, API, agent, automation, patching, scripting, remote-session, identity, credential, integration, and configuration activity rather than relying on sign-in records alone.
How often should an MSP review RMM audit logs?
Monitor or alert on high-risk events continuously when practical. Add a documented recurring review at a cadence based on risk, contracts, and obligations, and review evidence after privileged changes, exceptions, incidents, and material platform updates. The checklist records both cadence and owner so gaps have a clear follow-up path.
How should RMM audit evidence be retained?
Keep authorized references in the checklist while storing sensitive exports, credentials, recordings, restricted reports, and customer data in approved evidence storage. Set retention periods from contracts, incident-response needs, legal obligations, and risk, then verify that exports preserve timestamps, identifiers, attribution, completeness, and integrity.