Information need: whether security incidents trigger actions that improve the current security situation. Measure: the number of incidents that trigger improvement actions; formula: incidents that triggered actions divided by all incidents; target above a threshold the organization defines. Evidence is the action plan linked to incidents; collected quarterly and reported every semester; the incident response team owns the information and the information security manager collects and is the customer; data are incident reports; the reporting format as printed repeats B.8's column chart of incident costs with its drill-down.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.