Procedures should be set for monitoring and measuring, whether manually or automatically, and for storing and verifying the results; data can be verified against a checklist so that the effect of missing data on the analysis is minimal and values are correct or within recognised bounds, and enough data should be collected for the analysis to be reliable. Measures should be collected, analysed, evaluated and reported to interested parties at the established periodicity, the processes reconsidered when any of the 8.3.1 conditions occurs, and before publishing reports or dashboards the organization should decide how and with whom collected data and results may be shared, because some security data are confidential; a separate check on how collection itself is working confirms that the correct measures are gathered repeatably, precisely and consistently.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.