Handle privacy and sensitive content in logs + cloud/SaaS log considerations per NIST SP 800-92 Section 5.11 (Confidentiality and Privacy) + updates aligned with modern cloud-era practice + GDPR + CCPA + sectoral privacy law + HIPAA Privacy Rule. Privacy and data minimisation: review what is captured by each log source + scrub or redact unnecessary personal data + pseudonymise where analytical value justifies retention + document the legal basis for log content under applicable privacy regimes + provide subject access pathways where required + apply data subject rights honoring deletion + correction + portability requests with logs scoped to investigative-necessity carve-outs where applicable + document the carve-out rationale. Sensitive content handling: never log passwords + tokens + cryptographic keys + cardholder data + clinical data + classified content + with technical enforcement (redaction filters + masking + sample-screened log reviews) + investigation when sensitive content is observed in logs + retroactive cleanup. Cloud and SaaS log considerations: enumerate consumer-controlled vs provider-controlled logs per service + understand provider retention and access constraints + plan for log export to consumer-controlled storage where regulatory or investigative continuity demands it + consider provider audit log SKU upgrades where richer detail is required + document the gap between desired and available logs per service + accept residual risk explicitly where the gap is unavoidable.
This control maps to 34 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 34 it maps to, and the evidence behind each claim, over MCP and REST.