Data are collected to know the degree of implementation of applicable measures and support the annual state-of-security report (Article 32); R1 measures the effectiveness of incident management and R2 the efficiency of the security system in hours and budget.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.