Backup and retention of audit trails. Level 1: audit trails of privileged activity, of access attempts whether authorised or not, of system exceptions and of security events are kept for an agreed period. Level 2 (a and b): audit trails are backed up regularly to a central log server or media accessible only to authorised staff, and logs of internet-facing systems are written to a log server on an internal, firewalled segment with no remote access and tightly controlled IDs. Level 3 is the same.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.