“If there's an issue, you need to have identified the logs you require up front, because if you're trying to change your logging when an incident happens, you've already lost.”

Transcript evidence from Chris John Riley -- MVSP: Minimum Viable Secure Product.