A B/D defines the log types and detail it needs (audit logs covering the network, systems, applications, administration and change activity), makes sure logs capture the cloud's dynamic events such as adding or removing virtual machine instances, defines retention periods, keeps logs tamper resistant, understands for public cloud whether the provider lets users change log settings and supplies the required data, reviews logs by procedures proportionate to system criticality and may use event correlation tools.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.