Evaluating how information security performs and how effective the ISMS is begins with monitoring and measurement. Because so many attributes could be measured, measuring too many of them, or the wrong ones, is impractical, expensive and self-defeating: the important issues get buried under a mass of information or are overlooked entirely. The organization should begin by deciding what it wants its evaluation of performance and effectiveness to achieve, derive its information needs from that, and only afterwards choose the measures that serve each separate information need and the data those measures depend on; measurement should always correspond to the organization's information needs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.