This objective requires your organization to define and document which types of events must be logged based on risk, compliance, and operational need—particularly for systems that handle Controlled Unclassified Information (CUI).