The eleven reporting areas each carry quantitative metrics, and Table 2 recommends for each metric whether a large organization and an SME should report it internally, externally (public disclosure) or both; the full set is 58 metrics, of which a smaller organization is recommended a reduced set (commentators count between 32 and 60 depending on size). The organization should select its metrics by this matrix and by materiality, report them consistently over time (4.1, 4.5.2) and give each area its risk and opportunity narrative (4.6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.