As a safeguard against intrusion and data misuse the entity must document and implement logging procedures, protocols and tools that define which events are logged, how long logs are kept (set by business and security objectives, the reason for logging and the risk assessment) and how log data is secured; match log detail to the purpose so anomalous activity can be detected; log events on logical and physical access and identity management, capacity management, change management, ICT operations and system activity, and network traffic and performance; protect logs and logging systems from tampering, deletion and unauthorised access at rest, in transit and where relevant in use; detect logging failures; and synchronise system clocks to a documented reliable time source.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.