Creating measures should begin with the information needs that shed light on how any part of the ISMS operates or performs, arising from interested-party needs, the organization's strategic direction, the objectives and policy for information security, and the risk treatment plan. To identify them the organization should examine the ISMS and its elements (its policy and objectives, its controls and control objectives; legal, regulatory, contractual and organizational requirements; the outcomes of the risk management process), prioritise the identified needs on criteria such as risk treatment priorities, capabilities and resources, interested-party needs, the policy, objectives and control objectives, the information needed to meet obligations that are contractual, legal, regulatory or organizational, and the value of the information against the cost of measuring, select from the prioritised list the subset to be addressed by measurement, and document and communicate the selected needs to all relevant interested parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.