The IED keeps a record of cybersecurity events in storage of a stated capacity, and each record carries the fields the 2013 edition required (its storage capability and storage record subclauses, which Table 1 says are now 5.5.2): (a) an event record number; (b) the time and date; (c) the identification of the user; (d) the event type. Records are retrievable by an authorised user; how and when old records are overwritten is stated by the supplier.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.