CA application logs carry a digital signature or an ISO 16609 symmetric MAC so that alteration is detectable, with the signing or MAC key protected in an SCD under the key-management requirements of the standard. In particular: online certificate-processing components sit behind firewalls that deny every service not explicitly permitted, have unnecessary services, protocols and ports removed, fail closed and need an administrator to re-enable services, disable source routing, reject external traffic bearing internal addresses, alert the administrator in near real time to break-ins, low disk space and similar conditions, and are administered only through authenticated encrypted sessions; online certificate-processing systems use network or host-based intrusion detection, or both, covering at least the database servers, the RA and web application servers and the segments between them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.