Identify the event types the system can log (authentication, file use, user and group management, events sufficient to establish what occurred, its source and outcome, and operational transactions such as NCIC and III), coordinate event logging with the other entities that need audit information, log all successful and unsuccessful logon attempts, attempts to use access, create, write, delete and change permissions on accounts, files, directories and other resources, password change attempts, privileged account actions and attempts to access, modify or destroy the audit log; give a rationale for the adequacy of the selection for after-the-fact investigations; and review the selection annually.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.