The governing body decides what effective IT performance means for the organization, drawing on its grasp of the organization's context and of what stakeholders expect, and sets out performance expectations plainly so that operational management, oversight of delivery and the use of IT can be anchored to them. Performance can also be judged on five points: how well digital capabilities are aligned to support and enable the organization's purpose; whether IT investment is appropriate, including the level of digitalization and innovation the organization needs; whether enough value is drawn from IT assets such as hardware and software and also from the data, the digital services and the people who build, maintain and use the capabilities; how the cost of data relates to the better decisions its use produces for the organization and its stakeholders; and how far digital capabilities make the organization agile and adaptable enough to sense, learn and respond to future opportunities, risks and obligations.
This control maps to 12 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 12 it maps to, and the evidence behind each claim, over MCP and REST.