A09:2025 Security Logging and Alerting Failures

OWASP Top 10:2025 · Back to the list

Security-relevant events aren't logged, alerts don't fire, or log integrity isn't protected — incidents go undetected.

Member CWEs (5)

CWE-117 Improper Output Neutralization for Logs
CWE-221 Information Loss or Omission
CWE-223 Omission of Security-relevant Information
CWE-532 Insertion of Sensitive Information into Log File
CWE-778 Insufficient Logging

Mapped NIST 800-53 r5 controls (127)

Our two-way, human-QA’d reading of how this category and each NIST 800-53 control relate. No external body publishes an OWASP→800-53 mapping, so these are our assessment.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-1→M AC-12→M AC-17→P AC-17.1←M →M AC-17.3→M AC-17.4→P AC-2→M AC-2.1←P AC-2.3→M AC-2.4→M AC-20.1→M AC-5→M AC-6.2→P AC-6.5→M AC-6.9→M AC-7→M AT-1→M AT-2→M AT-2.2→M AT-2.3←P →M AT-3←P →M AU-11→M AU-12←M →M AU-2←M →M AU-3.1→M AU-4←P →M AU-5←M →M AU-6→M AU-6.1→M AU-6.3←M →M AU-7←M →M AU-7.1←M →M AU-8←P →M AU-9→M AU-9.4←P →M CA-1→M CA-2←P CA-2.1←P CA-3→P CA-5←M CA-6→M CA-7←P CA-7.1←P CA-7.4←P →M CA-9→M CM-1→M CM-2→P CM-2.2→M CM-3.4→M CM-4←P CM-8→M CM-8.3←P CM-9→M CP-1→M CP-10→M CP-2.1→M CP-2.3→M CP-4→M CP-4.1→M CP-8→M CP-9→M CP-9.8→M IA-11→M IA-2.1→P IA-3→M IA-4→M IA-5.6→P IA-8.4→M IR-3←P →M IR-3.2→M IR-4←P →M IR-4.1←P →M IR-5←M →M IR-6→M IR-6.1←P →M IR-7→M IR-7.1→M IR-8←P →M MA-1→M MA-2→M MA-3→M MA-4→M MP-2→M PE-6←P PE-6.1←P →M PE-8←P →M PL-1→M PL-11→M PL-2→M PL-8→P PS-1→M PS-2→M RA-1→M RA-3←P RA-5←P RA-5.5→M RA-7←P SA-1→M SA-10→P SA-2→M SA-22→M SA-3←P SA-4←P SA-5→M SA-8←P SC-1→M SC-10→M SC-18→M SC-28→M SC-5→M SC-7→M SC-7.3→M SC-7.4→M SC-7.5→M SC-7.8←P SC-8→M SC-8.1→P SI-1→M SI-3←P SI-4→M SI-4.2→M SI-4.4←M SI-7←M SI-7.1←P SI-7.7←P →M SR-10→M SR-8→M

Tagged CVEs (showing 50 most recent of 1,460)

Data: OWASP Top 10:2025 (CC BY-SA 4.0) · CWE memberships from cwe-api.mitre.org (meta-category CWE-1444).