Information need: current firewall performance. Measure: unused rules on border firewalls; formula: how many rules on the border firewalls were never triggered during the latest sampling period; target: none. Evidence is the records of the usage counters on each rule; bi-annual or yearly; the network manager or information security manager owns and is the customer, the network or security analyst collects; data are the firewall management console and the firewall review report; reported as a count or list of unused rules marked for review and possible deletion.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.