Management retains logs under policies that reflect their value for incident response and analysis, strictly controls and monitors access to log files on hosts and in the central repository, secures their integrity by encrypting sensitive or transmitted logs, providing enough storage, securing backup and disposal, logging to a separate isolated system or read-only media, preventing modification of written data and limiting access to a few authorised users, has logging practices reviewed periodically by an independent party, and may use SIEM systems to collect, aggregate, correlate and analyse logs from network and security devices, identity systems, vulnerability tools and operating system, database and application logs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.