Where a special condition produces security logs, operators retain the logs extracted from the aircraft network, using the transfer methods, retention times and tools the design approval holder specifies, analyse them continuously or on schedule for anomalies to an extent consistent with their threat profile, specify frequency, storage, retrieval and analysis in the ANSP, and retain and analyse them after an NTSB-reportable event possibly linked to a security event; keeping a working copy and an unaltered copy, securely transmitted and stored, is recommended. D301 generally requires surveillance of the ANSP to verify compliance and identify threats, with threats analysed and reported under the operator's IT security policies, including forwarding relevant threats and events to CISA in line with TSA directives; surveillance is documented in the Continuing Analysis and Surveillance System for technical issues and in the annual security assessment for threats; Service Difficulty Reports are never an acceptable reporting route.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.