Audit logging captures user actions with timestamp + user ID

Without structured audit logs, there is no forensic record of who accessed sensitive data, who changed permissions, or when an account was compromised — making incident response guesswork and regulatory compliance impossible. NIST 800-53 rev5 AU-2 (Event Logging) defines the minimum event set; AU-3 (Content of Audit Records) mandates user ID, timestamp, event type, and outcome in every record; AU-12 (Audit Record Generation) requires the system to generate these records reliably. CMMC 2.0 AU.L2-3.3.1 and FedRAMP rev5 AU-2 enforce this for any system handling federal or controlled unclassified information. Missing audit trails also violate incident-reporting obligations under many state and federal data breach notification laws.

Create a centralized logAuditEvent function and call it at every authentication, permission change, and destructive operation. Structure logs as JSON so they are machine-parseable by SIEM tools.

// lib/audit-logger.ts
import pino from 'pino'

const logger = pino({ level: 'info' })

export function logAuditEvent({
  userId,
  action,
  resource,
  outcome,
  detail
}: {
  userId: string
  action: string
  resource: string
  outcome: 'success' | 'fail'
  detail?: string
}) {
  logger.info({
    ts: new Date().toISOString(),
    userId,
    action,
    resource,
    outcome,
    detail
  })
}

Call logAuditEvent for at minimum: login/logout, failed login attempts, role changes, record deletions, and admin actions. Retain logs for at least 90 days per AU-11; ship them to a managed log service (Datadog, CloudWatch, Logtail) rather than local disk.