The organization should define specific timeframes for monitoring, measurement, analysis and evaluation based on each information need, the measures required and the lifecycle of the supporting data; data can be collected more often than it is analysed and reported (incident data continually, external reporting by severity or as aggregates). Enough data must be collected before analysis and evaluation can give a meaningful basis for comparison, the processes may have to be tested and adjusted before the measures they yield are of use, and the organization should set a limit on the fine-tuning period and decide how long collection runs before analysis begins. Timeframes can be adjusted as measurement activities are updated for the environmental changes of 8.3.1 (a move from a manual to an automated data source can change collection frequency), comparing two sets of measures gathered at different times or with different methods calls for a baseline, where both serve for the same information need, and activities may be structured as a measurement programme although ISO/IEC 27001 does not require one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.