Extends ISO/IEC 27002:2022 8.15, which absorbs 2019's event logging and log protection guidance. Logs are reviewed on a stated, documented cycle to spot irregularities and propose fixes; where possible they show whether an event added, modified or deleted PII and who did it (roles may differ or be shared among providers in different service categories). The processor decides and documents the conditions under which the customer may receive or use log information and shares those procedures; a customer allowed into logs the processor controls sees only records of its own activities. Logs kept for monitoring or diagnostics can hold PII, so access restrictions keep them to their intended use, and a procedure, automated by preference, deletes them within a stated, documented period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.