Considering ISO/IEC 27001:2013, 9.1 and 5.3, the organization should name, as individuals or as roles, the people who monitor, measure, analyse and evaluate, whether the work is manual or automated, and can define seven measurement roles: the measurement client (management or other interested parties needing to know how effective the ISMS is, a control or a group of controls); the measurement planner (who defines the measurement constructs linking measurable attributes to an information need); the measurement reviewer (who validates that the constructs are appropriate); the information owner (who owns the input information, provides the data and often conducts the measurement); the information collector (who collects, records and stores data); the information analyst; and the information communicator (who communicates the results of analysis). Roles can be combined, and the people holding them can need different skills, awareness and training.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.