The TSF can include or exclude events from the set actually audited during operation, chosen from the full set of auditable events by attributes such as identity, event type or object. One component: FAU_SEL.1 Selective audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.