Avoid treating Centralized security logging as a one-time purchase or checklist item. Tie it to the intended outcome—collects time-aligned security events in a protected searchable repository—assign accountability, measure coverage and effectiveness, review exceptions, and update it when threats, systems or business requirements change.

NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework