V16.3.1: Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.
ASVS Maturity
V16.3.2
V16.3.2: Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).
ASVS Maturity
V16.3.3
V16.3.3: Verify that the application logs the security events that are defined in the documentation and also logs attempts to bypass the security controls, such as input validation, business logic, and anti-automation.
ASVS Maturity
V16.3.4
V16.3.4: Verify that the application logs unexpected errors and security control failures such as backend TLS failures.