Governance should make sure the way information is protected is fit for purpose and delivers the agreed levels of security, with performance tracked and held at the levels that present and future requirements call for. The governing body should judge security performance by its effect on the entity as a whole, and not only by how effective and efficient controls are. Top management in each ISMS should be asked to run a programme for measuring performance that monitors, audits and finds opportunities for improvement, and the governing body should tie information security performance to how the organization and the entity perform.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.