Information need: how good the passwords are that users rely on when logging on to the organization's IT systems. Measure: the total number of passwords complying with the password quality policy, as the ratio of compliant passwords and the trend of that ratio; formula: count the passwords in the user password database, determine those satisfying the policy, divide compliant by registered passwords and compare with the previous ratio. Target: achieved with no action above 0.9; between 0.8 and 0.9 not achieved but a positive trend indicates improvement; below 0.8 immediate action. Evidence is the count on the password database, the compliant count, and the password settings, configuration file or configuration tool; collected at least yearly depending on criticality, analysed and reported after each collection, reviewed yearly; the system administrator owns, security staff collect, the ISMS managers and security manager are clients; data are the user password database and individual passwords; reported as a trend line of compliant passwords superimposed on previous periods.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.