OWASP Top 10:2025 OWASPTOP10-9: A09:2025 Security Logging and Monitoring Failures
Address OWASP Top 10 A09 Security Logging and Monitoring Failures per OWASP Top 10:2025. Security Logging and Monitoring Failures arise from insufficient logging + monitoring + alerting + and incident response capability including missing audit logs + missing anomaly detection + missing incident response readiness + log injection + and information exposure via error messages. Mitigations include (a) log security-relevant events including authentication + authorisation + administrative actions + with sufficient context + (b) protect log integrity + confidentiality + availability + (c) integrate with SIEM + monitoring + alerting + (d) implement anomaly detection + incident response workflows + (e) handle errors without leaking sensitive information + (f) maintain retention aligned to regulatory + investigative + governance requirements + (g) protect against log injection.
What else in your programme already covers this
This control maps to 136 controls across 92 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
3.3.1 SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
3.3.1 SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.