Information need: the organization's current visibility of its systems' vulnerabilities. Measure: the ratio of systems that have been the object of vulnerability assessment or penetration testing; formula: systems assessed in the last quarter or penetration tested in the last year divided by total systems; target 1. Evidence is analysis of vulnerability assessment and penetration testing activity; quarterly; ownership sits with the security analysts or with third parties engaged under contract, collection with the analysts, the information security manager is the customer; data are vulnerability assessment reports and tools and penetration test reports; reported as an aggregate pie chart and pie charts per homogeneous or sensitive system group showing the ratios obtained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.