The organization should set up and keep procedures for tracking and measuring how its security management system performs, to confirm it remains suitable, adequate and effective. In deciding how often the key performance parameters are measured and monitored, it should take account of the threats and risks involved, including the ways measures may degrade over time and what would follow if they did.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.