Annex C shows that a construct need not use the Table 1 template: in a free-text example the question is whether formal training conveys the information security policy better than making it available online. From the total staff (S1), the staff who acknowledged reading the online policy (S2) and the subset who attended awareness training (S3), and the pass and fail counts on a common test for the read-only group (S4P, S4F) and the trained group (S5P, S5F), the construct derives E1 = S1 minus S2 (staff who have not yet seen the policy at all, with a threshold that can trigger an alert and a period within which new starters must read it), E2 and E3 as the pass proportions of the two groups, and E4 = E3 divided by E2 as the effectiveness ratio of training against self-instruction; over time the thresholds can be raised as the culture matures and the failed questions analysed to improve the policy's wording or set more realistic goals.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.