Effectiveness measures describe the effect and impact that realising the risk treatment plan, the ISMS processes and the controls have on the information security objectives, and are used to determine whether processes and controls operate as intended and achieve their outcomes: they can quantify cost savings from the ISMS or costs incurred from incidents, the customer trust gained or maintained, and the achievement of other objectives. They are built by joining data produced by automated tools for monitoring and evaluation with data about ISMS activity that people gather by hand, which requires an established capability to evaluate implementation through performance measures, collect from automated tools, collect manually, normalise and analyse data from multiple sources, and interpret and report to decision makers. They set progress on the risk treatment plan alongside information on resources, feed the risk management process and show top management most directly what information security is worth. Example 3 is risk exposure from unpatched known vulnerabilities; Example 4 is whether trainees understood and can apply each lesson, from post-training tests, incident data and help desk calls, each matched to the topics trained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.