The organization should monitor and measure ICT readiness against the performance criteria it defined, including the time it takes to react to and respond to emerging incidents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.