The organisation judges its plans, procedures and capabilities for managing security operations through periodic assessment, testing, post-incident reporting, lessons learned, performance evaluation and exercises, and keeps records of what it finds. It determines what needs monitoring and measuring, the methods that give valid results, when monitoring and measurement are performed and when the results are analysed and evaluated, and it uses the results to judge the performance and effectiveness of the system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.