Each measure should answer the information need, relying on current practices or new ones, adapting existing measures where possible, and be defined in enough detail to implement. Candidate data include logs and scans, training and HR statistics, surveys and questionnaires, incident statistics, internal audit results, continuity and recovery exercise results and management review reports, of internal or external origin. Measures should be chosen in order of how important the information needs are, and the choice can weigh ease of collection, available people, tools, the number of indicators a measure supports, ease of interpretation, the number of users of the results, evidence of fitness for purpose and the cost of collecting, managing and analysing. Each measure should be documented in a form that ties it to its information need and gives enough about its characteristics and on how it is gathered, analysed and reported, using the Table 1 descriptors: measure ID, information need, measure (a percentage, number, frequency or average), formula or scoring, target (a milestone, statistic or thresholds, with ongoing monitoring to confirm continued attainment), implementation evidence (which also helps find the causes of poor results), frequency (possibly several), responsible parties (as a minimum the measurement client, the information collector and the information owner), data source and reporting format; an optional action descriptor states what is done when the target is missed. Different measurement clients can need different measures or granularity, each measure should serve at least one information need and one need can require several measures, data should be collected once and used for many purposes, what is easiest to measure is not necessarily most meaningful, combining subjective measures can distort the result, and targets should describe the final state being aimed for and can be set from historic data with the caution that targets based on past performance can perpetuate the status quo.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.