Monitor privileged actions
Security and data protection: Monitor privileged actions. Starts when: Continuous. Steps: Collect receipts for owner and operator actions; Review anomalies; Record outcome. Done when: Every privileged action has a receipt in the log. Rules that apply: FCA SYSC 13; ISO 27001 A.12.