The measurement information model of ISO/IEC 15939 (Figure A.1) can be applied to an ISMS: it ties an information need to the entities that matter (for example processes, controls, documented information, systems, devices, resources and personnel; for example the risk management process, the audit process, information classification, access rights management, the information security policy, the mobile device policy, a back-end computer, an administrator or an employee) and their attributes, quantifies the attributes as base measures, combines two or more base measures through a measurement function into derived measures, and turns those into indicators on which decisions can rest; depending on how much they matter to what the organization is trying to do, some of these can be singled out as key performance indicators (or key success indicators) can be identified. The model tells the measurement planner what to specify, and is one example of an approach that fulfils the ISMS measurement requirements rather than the only one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.