The plan must require a security audit capability for assets, zones and conduits covering generation, retention, review and protection of audit records; consistent criteria for the event types audited; audit events for security-related configuration changes; records showing event type, date and time, source, outcome and associated accounts or identities; consistent criteria for allocating and managing audit storage according to risk and asset capability; no loss of essential functions on audit processing failure unless a risk assessment supports it; identification of risk to audit records, which are authorised, validated, protected and classified by their protection needs; and consistent, risk-based criteria for how often audit records are reviewed. At the Extended Profile personnel are alerted when audit processing fails.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.