Governance should build on the culture of the entity and on the changing needs of all interested parties, because how people behave is central to security. Where objectives, roles, responsibilities and resources are not coordinated they work against each other and every objective suffers, so interested parties need to be brought into line and pointed in the same direction. Top management should call for, encourage and back the coordination of what interested parties do so that it follows one coherent direction, which in turn supports security education, training and awareness. Information security duties should form part of the roles of staff and others, and by accepting those duties they help each ISMS succeed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.