Information need: how far agreements with third parties deal with security. Measure: on average, what share of the relevant security requirements those agreements cover, as a percentage; formula: the sum over agreements of required requirements minus addressed requirements, divided by the number of agreements, times 100; target 100 percent. Evidence is the supplier database and agreement records; collected quarterly and reported semi-annually; the contract office owns, security staff collect, the security and business managers are clients; data are the supplier database and agreement records; reported as a line chart of the trend over several periods with a short summary and possible management actions. The example notes that it assumes all requirements are equal when they are not, so an average can hide significant variation and give a false sense of security, that suppliers and their ability to meet requirements differ, and that the supplier database should carry a security rating or category so that suppliers are not all measured the same way.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.