Can You Prove What Happened After An Incident?
When something goes wrong with information - a suspected breach, an accidental disclosure, a suspicious access event - the first question from regulators, clients and insurers is: what happened, and what did you do about it? Most organisations cannot answer clearly.
"A client contacts your business to report that they have received phishing emails referencing details only your firm should have. They believe their information may have been compromised through you. Your management team begins investigating - and within an hour it is clear there are no access logs, no audit trail, and no way to determine what happened to that client's file over the past twelve months."
POPIA's security safeguards condition and the Regulator's Conditions of Lawful Processing require organisations to document information security incidents and demonstrate a reasonable response. Audit logging - recording who accessed, modified or shared specific records, and when - is the technical foundation of incident response capability. Most enterprise platforms (Microsoft 365, Google Workspace, modern CRM and accounting systems) include audit log functionality as a standard feature that must be explicitly enabled. Forensic capability - the ability to reconstruct a timeline of events - depends on log retention periods being configured appropriately: typically 90-365 days for SME environments. Without logs, the organisation cannot distinguish between 'nothing happened' and 'something happened that we cannot detect.'
ComplyBar helps businesses identify hidden risks in how information, AI tools, email, documents and cloud systems are used.
Built for POPIA support, AI governance, data leak prevention, employee risk awareness, information governance and audit evidence.