Information need: how many employees received ISMS awareness training and compliance with the information security policy. Measure: the percentage of employees who took ISMS awareness training; formulas: I1, employees who received the training divided by those who must receive it, times 100; I2, employees who renewed it in the last year divided by employees in scope, times 100. Target green when I1 exceeds 90 and I2 exceeds 50 percent, yellow when I1 exceeds 60 and I2 exceeds 30, otherwise red, with red requiring intervention and causation analysis, yellow close watching and green no action. Evidence is participation lists and registries marked received; collected monthly on the first working day, analysed and reported quarterly, reviewed annually, annual period; the HR training manager owns and collects, the ISMS managers and chief information security officer are clients; data are the employee database, training records and participation lists; reported as a colour-coded bar graph with a short summary and possible management actions, or a pie chart with a line chart of the evolution.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.