Information need: compliance with the security awareness policy among relevant personnel. Measures: progress to date and progress to date with signing; formulas: progress to date from the status of all personnel who have signed and were planned to complete by now, progress with signing as personnel who have signed divided by personnel planned to sign, the ratio of progress to personnel planned times 100, and comparison with previous statuses. Target: ratios in the range 0.9 to 1.1, and 0.99 to 1.01 respectively, mean the goal is met and nothing needs doing, and the trend should be upward or stable. Evidence is the count scheduled to have signed and completed training, the responsible person's percentage of those who completed and signed, those scheduled to have signed and those who signed user agreements; collected monthly, analysed and reported quarterly, reviewed annually, annual period; the information security officer and training manager own, HR training management collects, ISMS managers, security management and training management are clients; data are the awareness training plan and schedule, personnel training status, the plan for signing user agreements and the signed-agreement records; reported with standard font for criteria met satisfactorily, italic for met unsatisfactorily and bold for not met.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.