In a company's cloud environment, each account keeps its own management plane, network and workload logs locally, and no one reviews them unless an incident is already known. Which audit mechanism should be implemented first?

Audit mechanisms are only effective when logs are collected, protected and analyzed. Centralized log collection aggregates management plane, network and workload logs from every account into a dedicated platform, typically a log archive feeding a SIEM, where retention is consistent, integrity is protected from workload administrators, and monitoring rules and analysts review events continuously. That converts logging from a passive record consulted after the fact into an active detective control, and it is the prerequisite for correlation and alerting across the environment. Extending local retention keeps more data available for reconstruction, but logs still sit unreviewed in each account, so incidents continue to be discovered late or not at all. Packet capture everywhere generates enormous volumes and cost, and without centralization and analysis it adds to the review problem rather than solving it; full capture is better targeted to specific investigations. Disabling logging in development accounts removes visibility in environments attackers often use as an entry point because controls there are weaker, and it reduces data rather than improving review. Exam caveat: centralizing logs also supports separation of duties, since the people being monitored should not control the logs about them. Operational check: confirm every account is forwarding management plane activity to the central platform and that at least one alert rule fires on a test event.