The organisation determines recovery metrics ahead of time, identifying what can be measured accurately and repeatably, designing collection as an automated output of recovery activities so that restoring the business stays the primary task, and ensuring metrics never hinder recovery or rush an investigation; it decides when metrics help (well-defined, repeatable activities such as routine malware re-imaging) and when they mislead (anomalous events, major compromises), may define a point of no return, shares metrics for compulsory reporting or information sharing only with the approval of senior management, legal and compliance, and draws on example areas such as incident damage and cost, risk assessment improvement and quality of recovery activities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.