Information need: the costs arising from a lack of information security. Measure: over the sampling period, the costs of all information security incidents added together; formula: the sum of the cost of each incident; target below an acceptable threshold the organization defines. Evidence is systematic gathering of the cost of each incident; quarterly; the computer security incident response team owns the information, the information security manager collects and top management is the customer; data are incident reports; reported as a column chart of incident costs for this and previous periods, with a drill-down to the average cost per incident and per predefined incident category.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.