If it moves, log it. If it’s doesn't, watch it and log it when it moves.

Assess impact

Business Impact Assessment: Determine logging requirements

Security requirements

Integrity and non repudiation

Security monitoring

Detecting events that are of interest