Information need: whether change management best practice and the hardening policy are respected. Measure: the percentage of newly installed systems that respected change management best practice and the hardening policy; formula: newly installed applications or systems with evidence of respecting the change practices divided by the total of newly installed applications; target: every system complies with the change management guidelines. Evidence is the ticketing system, emails, reports and the configuration checklist; collected each semester, reported yearly to management and each semester to the information security manager; the risk owner owns and collects, the information security manager is the client; data add the configuration review tool report; reported as a pie chart of the current position and a line chart of the evolution.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.