Information need: the performance of corrective action implementation. Measures: the ratio of corrective actions not implemented, the ratio not implemented without reason, and the trend of both; formulas: actions not implemented divided by actions planned to date, actions not implemented without reason divided by actions planned to date, and comparison with previous statuses. Target: the first ratio no higher than 0.4 (ideally zero) and the second no higher than 0.2 (ideally zero), with the trend declining for the last two reporting periods and presented against previous indicators. Evidence is the count of actions planned to date, recorded as implemented by the due date, and recorded as not taken with the reason; collected, analysed and reported quarterly, reviewed annually and applicable one year; the ISMS managers own and collect, with the information security manager also a client; data are corrective action reports; reported as a stacked bar chart of implemented, not implemented without legitimate reason and not implemented with legitimate reason, with an executive summary and possible management actions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.