Information need: whether the requirement for yearly awareness training in information security is being met. Measure: the percentage of personnel who received the annual awareness training; formula: those who received it divided by those who need it, times 100. Target red at 0 to 60 percent, yellow at 60 to 90, green at 90 to 100, and a yellow rating becomes red automatically if progress of at least 10 percent per quarter is not achieved, with the same intervention, watch and no-action meanings. Evidence is the count of registries marked received; collected monthly, analysed and reported quarterly, reviewed annually, annual period; the information security officer and training manager own the information, HR training management collects, and the ISMS managers, security management and training management are clients; data are the employee database and training records; reported as a colour-coded bar graph with summary and possible management actions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.