Which performance measures are chosen depends on the sector, on top management's criteria and on the organization's culture, and most organizations already have performance data they can use to assess resilience, in management information, internal audit reports, business reviews and project reports. Top management should: set objectives for organizational resilience; develop criteria for monitoring and evaluating the state of the resilience attributes; monitor and evaluate the maturity and performance of resilience as a whole; decide what will be monitored and evaluated and which methods will give valid results and allow assessment to continue over time; set the thresholds at which evaluation results are acceptable; decide how resilience evaluation and monitoring will run alongside, support or merge with existing monitoring processes; and settle how the results will be analysed, evaluated and reported.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.