Design and operate the log management infrastructure per NIST SP 800-92 Chapter 3 (Log Management Infrastructure) + Chapter 5 (Operational Processes). Log management infrastructure architecture per Section 3.2: (a) tiered architecture covering generation + collection + storage + analysis + reporting, (b) high-availability across collection and storage tiers with documented RTO/RPO, (c) capacity sizing per Section 3.4 with documented log volume forecasting + growth model + headroom planning. Centralised log collection per Section 3.2.2: forwarders or agents (host-installed + sidecar + agentless cloud + tap) deliver to one or more central log management systems + minimise local log retention to reduce attacker advantage. Log transport security per Section 5.3: encrypted in transit (TLS preferred + IPsec + or equivalent), authenticated source + destination, integrity validation, queue/buffer for network outages with replay-on-recovery. Log forwarding agents and health monitoring per Section 5.4: monitor agent liveness + version + configuration drift + delivery success rate + back-pressure + queue depth + with alerting on agent silence (silent failure is the most common log-management failure mode). SIEM and detection platform governance: documented platform owner + platform SLA + correlation rule lifecycle + analyst onboarding + tuning cadence + use-case coverage per MITRE ATTandCK + integration with case management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.