An explicit risk assessment sets how often the entity checks that log files still exist unaltered throughout the retention period, and an independent official separate from operations carries out the verification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.