For CONFIDENTIAL, SECRET and TOP SECRET systems, agencies must log at least these events for every software component: all logon activity or attempts; the date and time; every privileged operation; failed privilege elevation attempts; security-related system alerts and failures; software upgrades or patching; system recovery activity; additions and deletions of system users and groups and changes to permissions; and unauthorised or failed attempts to reach systems and files the organisation has identified as critical.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.