Every key-management operation (generating, loading, transmitting, backing up, recovering, compromise handling, destroying, and generating and revoking certificates) is captured in audit trails, together with who authorised it and everyone who handled key material, and the logs are shielded from alteration and destruction. In particular: audit logs are archived for two years or more; issuance and revocation records are kept for at least as long as the certificate lives; each operating-system and CA application event is logged with its date and time, the user or entity responsible, the kind of event, and whether it succeeded or failed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.