Across the servers that run critical business applications, infrastructure servers, security appliances, the engineering and service consoles of industrial control systems, network gear and the workstations administrators use, the entity automatically logs as a minimum every log-in and authentication event, every change to user profiles or permissions, every edit to security settings, and the running state of the systems. Each entry carries the exact time the event occurred. All components keep synchronised time: representations follow BDS ISO 8601-1 and 8601-2, events of legal or technical significance are recorded to the second (to the millisecond where technology demands), and clocks are synchronised with NTP version 4 or later (RFC 5905) to UTC or an equivalent scale.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.