Information need: how good the passwords are that users rely on when logging on to the organization's IT systems. Measures: the total number of passwords and the total uncrackable; formulas: the ratio of passwords crackable within four hours and its trend, computed as uncrackable divided by total and compared with the previous ratio. Target: achieved with no action above 0.9; between 0.8 and 0.9 not achieved but a positive trend indicates improvement; below 0.8 immediate action. Evidence is a query on employee account records and a password cracker run against them using a hybrid attack; collected, analysed and reported weekly, the measure reviewed yearly and applicable three years; the system administrator owns, security staff collect, ISMS managers and the security manager are clients; data are the employee system account database; reported as a trend line of crackability for all records tested, superimposed on previous tests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.