Information need: how many critical systems have their users' access rights reviewed in a systematic way. Measure: what percentage of critical systems undergo periodic review of user access rights; formula: critical systems with periodic reviews divided by all critical systems, times 100; target green at 90 to 100 percent, orange at 70 to 90, red below 70. Evidence is proof of review such as emails, tickets or a formal review completion record; collected whenever something changes, for example a person is promoted, demoted or leaves, and reported each semester; the risk owner owns, the chief information security officer collects, the information security manager is the client; data are the asset inventory and the system that tracks reviews, such as a ticketing system; reported as a pie chart of the current position and a line chart of the evolution.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.