Define ISCM metrics per Section 3.2 covering security control effectiveness + system + organizational metrics + leading and lagging indicators + Cyber-Resilience metrics + KPIs (Mean Time to Detect MTTD + Mean Time to Respond MTTR + Mean Time to Remediate MTTR + Mean Time Between Failures MTBF). Establish monitoring and assessment frequencies based on control volatility + system categorisation + risk tolerance + threat environment + resource constraints. Apply continuous (real-time + near-real-time) for high-volatility controls + periodic (daily/weekly/monthly/quarterly) for lower volatility + annual for stable controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.