Unlike a technical log this is about business traceability: who changed the price, who granted approval, who exported the data.
It is required by auditors, by customers in contracts, and increasingly by regulation.
How you notice it
- After an incident nobody can reconstruct who did what.
- An auditor asks for evidence.
- Logs sit where they could be tampered with.
Frequently asked
What has to be logged?
Who, when, what, from where, and the outcome. What matters is that logs are stored separately and cannot be altered by the application. A log on the same server an attacker takes over proves nothing.