Every removal of keys, components or related material from secure storage and every load to an SCD is logged, the logs are stored securely such as with the components, kept for at least two years after the key is destroyed, and record date and time in and out, component identifier, purpose, the custodian's name and signature, a non-custodian witness's name and signature and the tamper-evident package number.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.