Information need: whether an access control system exists, how far it reaches and how good it is. Measure: the strength of the physical entry control system on a 0 to 5 scale: 0 no access control system; 1 PIN code entry (one factor); 2 pass card entry (one factor); 3 pass card and PIN; 4 the previous with log functionality active; 5 the previous with the PIN replaced by biometric authentication; target 3 is satisfactory. Evidence is a qualitative assessment in which each grade includes the one below, inspecting the card system, PIN use, logging and biometrics; collected, analysed and reported yearly with a twelve-month revision and applicability; the facility manager owns, internal or external auditors collect, the management committee is the client; data are identity management records; reported as graphs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.