What it means
Useful programs decide which events matter, preserve time and identity context, protect log integrity, define retention, establish baselines, and connect alerts to an accountable response process.
Why it matters
Without reliable records, organizations struggle to detect misuse, reconstruct events, prove control operation, or learn from incidents.
Practical focus
- Log authentication, privilege, configuration, and sensitive actions
- Synchronize time and retain source context
- Protect logs from unauthorized alteration
- Test that important events create usable records
Common mistakes
- Collecting logs that nobody reviews
- Alerting without an investigation owner
- Ignoring logging failures and coverage gaps
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: