An audit log records at least user or entity, date and time, information affected, event type and result, with server logs enabled; R1 reviews logs periodically for anomalies, R2 synchronises clocks with authenticated sources, R3 defines audited events and retention, R4 restricts log access and deletion, R5 adds automated review, correlation and response (SIEM).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.