Information need: whether staff are prepared to react properly to social engineering attacks. Measure: the percentage of staff who react correctly to a test such as a simulated phishing email to selected staff; formulas: a, staff who clicked the link divided by participants; b, one minus the number who reported the dangerous email through the proper channel; c, staff who followed the instruction after clicking (started revealing a password) divided by participants; d, a weighted sum of these appropriate to the nature of the test; target on d red at 0 to 60, yellow at 60 to 80, green at 90 to 100. Evidence is how much traffic reaches a mock command-and-control address, respecting personnel privacy and anonymising data so participants need not fear negative consequences; collected anywhere from monthly to yearly, according to how critical social engineering is judged to be, and reported per collection; the chief information security officer owns, an IT security officer trained in privacy aspects collects, and the risk owner is the client; data are the staff or user list and the awareness support and communication channels; reported as a test report with details, measurements, analysis, recommendation, target and agreed treatment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.