ISO/IEC 20000-1 (9.4) requires reporting requirements and their purpose to be determined, and service reports can help maintain and improve security, for example by reporting security incidents and their effect on service level targets. Because the ISMS defines controls whose effectiveness should be measured (ISO/IEC 27001, 9.1), the two can be integrated so that relevant and timely information sustains or improves security, and customers can see the true performance of services when control compliance levels and incident statistics appear in reports. ISMS and SMS reports, whether internal or customer-facing, should be designed with this in mind.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.