Passing regulation requiring audit logs sounds like a good first step.