Event logs are stored centrally in a capability that keeps them safe from unauthorised reading or alteration; the logs are shielded from access, modification and deletion by encryption in transit and at rest and by hardening of the systems and accounts that store, manage and analyse them; and the high-value security logs, and the configuration changes, generated by infrastructure, by operating systems and by applications are all shipped to that central store. Marked for every technical domain.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.