Measures should be created once and thereafter reviewed and systematically updated at planned intervals, or whenever the ISMS environment changes in a substantial way, such as a change in ISMS scope, organizational structure, interested parties and their roles, responsibilities and authorities, business objectives and requirements, legal and regulatory requirements, desired results having been reached and held steady over several cycles, or information processing technologies and systems being brought in or retired. The work of creating or updating measures involves identifying current security practices that can support the information needs, developing or updating the measures, documenting them and defining implementation priority, and keeping management informed and engaged; an update should need less time and effort than creating the measures did in the first place.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.