Management uses metrics suited to its IT environment, such as the number of open IT risk issues including threat intelligence findings, the number of risk acceptances approved by senior management with their documentation, the number of current and historical events deviating from control standards and the number of unresolved issues raised by business units, internal and external audit and regulators, together with key risk and key control indicators that direct attention to potential problems, and provides appropriate metrics or summaries to the board.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.