To simplify, our goals is to have our systems auditable and log everything we do with sensible data, and to have central control of user accounts and authorizat

To simplify, our goals is to have our systems auditable and log everything we do with sensible data, and to have central control of user accounts and authorization info. We want to have logs of what happened in case of an incident aswell as restrict access to only those who need it. We are also redesigning internal tools to only show relevant data. We want to have alarms on unusual events aswell. This is most of the system/infrastructure work, we also introduced new contracts (DPA) for our sub-contractors and cloud enviroments and a shitload of other risk analysis docs and stuff like that. This is for an ISP in eu.