Providers must record all access to security critical functions and who obtained it; identify and record access exceeding a person's security permission; have means to produce immediate alerts of every manual amendment to security critical functions; promptly analyse all activity on those functions; hold the required data securely for at least 13 months; and prevent activities that would restrict monitoring.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.