The control system must be able to generate security-relevant audit records in eight categories: access control, request errors, events in the operating system, events in the control system, backup and restore, changes to configuration, possible reconnaissance, and audit log events; each record holds a timestamp, a source (the originating device, software process or account of a human user), a category, a type, an event ID and a result. RE 1 requires central management and storage of the audit events in a system-wide, time-correlated trail that can be exported in industry-standard formats.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.