Monitoring establishes what state a system, process or activity is in, so as to satisfy a specified information need, and the things that can be monitored include implementation of ISMS processes, incident management, vulnerability management, configuration management, security awareness and training, access control, event logging (firewall logs and others), audit, the processes for assessing and treating risk, third-party risk management, business continuity management, physical and environmental security management and system monitoring. Monitoring yields data (for example incident information, training statistics, event logs and user interviews) that other measures can use, and defining measured attributes can call for additional monitoring. Monitoring can show that a risk has materialised and indicate the treatment; and where a control's explicit purpose is monitoring, the measurement process should record whether its data were obtained before or after a treatment action.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.