H01
Observability & Audit
WHAT IT ADDRESSES
Decisions cannot be reconstructed after an incident.
VERIFICATION METHOD
Log sample against a known action sequence.
TC260; OWASP T&M