The TSF records security-relevant events that happen under its control: the family fixes the level of auditing, lists which event types must be auditable and sets the minimum content of an audit record. Components: FAU_GEN.1 Audit data generation (what is recorded and what each record contains) and FAU_GEN.2 User identity association (each auditable event is tied to the identity of the user who caused it).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.