Are servers configured to capture who accessed a system & are proper processes, such as a chain of evidence, followed to ensure that information collected can be used for disciplinary or legal action?

Yes, privileged access to production systems is only granted to specific engineering members. Access is time constrained and limited to authorised engineers. Access is given via an internal tool and AWS Systems Manager, which integrates with our Identity and Access Management. All session activity is logged.