At least weekly, IT personnel other than the system administrator review each day's event logs for the prior week for the events in #8, documenting the date and time of review, the reviewer's name and title, exceptions and their follow-up. Reviewers must be independent of system and user access administration (or an employee independent of the department using the system); automated alerting may serve as evidence if the review details are recorded; where an IT service provider is used, the review or the alerts go to the licensee's own IT employees.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.