Handle privacy and sensitive content in logs + cloud/SaaS log considerations per NIST SP 800-92 Section 5.11 (Confidentiality and Privacy) + updates aligned with modern cloud-era practice + GDPR + CCPA + sectoral privacy law + HIPAA Privacy Rule. Privacy and data minimisation: review what is captured by each log source + scrub or redact unnecessary personal data + pseudonymise where analytical value justifies retention + document the legal basis for log content under applicable privacy regimes + provide subject access pathways where required + apply data subject rights honoring deletion + correction + portability requests with logs scoped to investigative-necessity carve-outs where applicable + document the carve-out rationale. Sensitive content handling: never log passwords + tokens + cryptographic keys + cardholder data + clinical data + classified content + with technical enforcement (redaction filters + masking + sample-screened log reviews) + investigation when sensitive content is observed in logs + retroactive cleanup. Cloud and SaaS log considerations: enumerate consumer-controlled vs provider-controlled logs per service + understand provider retention and access constraints + plan for log export to consumer-controlled storage where regulatory or investigative continuity demands it + consider provider audit log SKU upgrades where richer detail is required + document the gap between desired and available logs per service + accept residual risk explicitly where the gap is unavoidable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.