Information needs: an all-round setting in which personnel, facilities and products are secure and accountable, and the integration of physical and information security protection so the organization's information resources are properly protected. Measure: the number of unauthorised entries into facilities containing information systems, a subset of physical security incidents; formula: this period's count of physical incidents that let someone in without authorisation, divided by last period's count, interpreted against context specific to the organization (for example how many physical incidents there were overall); target below 1.0. Evidence comes from methodically analysing reports of physical security incidents together with the access control logs; quarterly gathering and reporting; the physical security officer owns, the incident response team collects, the chief information officer and chief information security officer are customers; data are physical security incident reports and physical access control logs; reported as a trend plot over recent periods; action: review the physical controls protecting information systems and strengthen them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.