Performance of planned activities and effectiveness of results can be measured with two types of measure: performance measures, which state planned results in terms of features of the planned activity itself (head counts, milestones, the degree to which controls have been implemented), and effectiveness measures, which state how the activities, once carried out, bear on the organization's objectives for information security. Both are inherently organization-specific, and the two terms are distinct from the ISO/IEC 27001:2013, 9.1 duty to evaluate information security performance together with how effective the ISMS is.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.