Under ISO/IEC 27001:2013, 9.1 the organization has to evaluate how its information security performs and how effective its ISMS is (the measure types of clause 7 serve that) and to determine six things: what is to be monitored and measured, the information security processes and controls among it; which methods are used to monitor, measure, analyse and evaluate, selected so that results are valid; when the monitoring and measuring is performed; who monitors and measures; when the results are analysed and evaluated; and who analyses and evaluates them. It also requires documented information to be retained as evidence of the results (8.9) and notes that valid methods produce comparable and reproducible results (6.4). Figure 1 maps each requirement to the clauses of this document.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.