Security-relevant events shall be logged with sufficient detail to support investigation, retained for periods aligned to government customer requirements (minimum one year), and monitored via 24/7 security operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.