What it means
Data events can be much higher volume than administrative events, so coverage and retention should reflect sensitivity, threat scenarios, legal needs, and investigation value.
Why it matters
Control-plane logs may show that a storage policy changed but not which objects were downloaded. Data-access evidence closes that gap.
Practical focus
- Prioritize sensitive and high-impact data stores
- Record the identity, resource, action, result, and network context
- Protect logs from the same administrators who access data
- Detect unusual volume, location, timing, and destination
Common mistakes
- Assuming audit logging is enabled by default
- Collecting data events without cost and retention planning
- Logging access while failing to monitor sharing changes
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: