For auditing purposes, websites are supposed to log events when administrators interact with the site.
Currently there are some holes in this logging. I haven't looked in much detail but things I have noticed missing are:
- File entity CRUD logging
- Bean entity CRUD logging
This may be an issue in terms of adhering to the ISM.