Performance measures demonstrate progress in implementing ISMS processes, procedures and specific controls and concern the extent to which they have been implemented as specified, drawing on data such as meeting minutes, attendance lists, project plans, the output of automated scanners and other routine records; collection, analysis and reporting should be automated wherever possible to cut cost, effort and human error. Example 1: the share of laptops whose hard disks are encrypted begins under 100 percent and, once it reaches and stays there, measurement can refocus on other controls; Example 2: when an ISMS is new, the first measure is top management attendance at review meetings against the planned full attendance. Once most performance measures have reached 100 percent and stay there, the emphasis and resources should shift toward effectiveness measures, but performance measures should never be fully retired because they point to controls needing improvement, and both performance and effectiveness should be measured at planned intervals.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.