The organisation must assess the effectiveness and maturity of its ISMS using adequate performance indicators, on a calendar basis it predefines and after any information security incident; where deficiencies are found it must take the improvement measures needed to keep the ISMS compliant and the risks at an acceptable level, and reassess the ISMS elements affected by those measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.