Ch. 6 — Audit, Evidence, and Accountability

Logging is not compliance. But without logging, compliance is impossible.

When a regulator asks what the agent did, you need a record. When an auditor asks whether the agent processed data as authorized, you need a record. When an incident occurs and you need to reconstruct what happened — to satisfy a breach notification requirement, to close a security finding, to answer a lawsuit — you need a record.

Without one, you cannot defend yourself. Without one, you cannot demonstrate compliance. Without one, you cannot prove the incident is contained.