Measurement establishes a value, a status or a trend in performance or effectiveness so that needs for improvement can be seen, and it can be used on any process of the ISMS, activity, control or group of controls; for example ISO/IEC 27001:2013, 7.2 c) can be measured both as how many people (or what share of them) have been trained and, for retained competence, by a post-training questionnaire. Several ISO/IEC 27001 clauses explicitly require that the effectiveness of some activity is established (10.1 d) requires reviewing the effectiveness of corrective action), which presupposes a defined information need and measure. Candidate ISMS processes are planning, leadership, risk management, policy management, resource management, communicating, management review, documenting and auditing; for information security performance the obvious candidates are the necessary controls determined by risk treatment (Annex A controls, sector-specific controls, controls from other standards, the organization's own), whose measurable attributes include how far a control reduces the likelihood or the consequence of an event, how many events it copes with before failure, and how long after an event it detects the event.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.