Log events at the BES Cyber System level or Cyber Asset level, per capability, for identifying and investigating Cyber Security Incidents, including at minimum detected successful logins, detected failed access and failed login attempts, and detected malicious code.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.