Are login failures logged? - Are access control failures logged? - Do logs include sufficient context (IP, timestamp, user, action)? - Are logs protected from tampering? - Is there alerting on suspicious patterns?