Ability to identify where organizationally defined events occurred, to support locating the source of the event, the time the event occurred, and the outcome of the event if there is one.
I'm not sure it's clear what the word "where" means in this bullet. Consider clarifying the use of the word "where." Does it refer to in which component of a device an event occurred?
There is a bullet in Audit Support that states:
I'm not sure it's clear what the word "where" means in this bullet. Consider clarifying the use of the word "where." Does it refer to in which component of a device an event occurred?