Information need: the organization's exposure to information security risks. Measures: high and medium risks lying above the acceptable threshold, and whether high and medium risks are reviewed on time; formula: a defined threshold for high and medium risks with responsible parties alerted when it is breached, and the number of risks without a status update; target 1. Evidence is the updated risk register; collected at least quarterly and reported each quarter; security staff own and collect; the data source is the information risk register; reported as two trends, one for high risks and one for high and medium risks that have been accepted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.