A catalog requirement says what a standard expects. It does not say which tool you use, who is accountable, or when you last checked it. An implemented control is that organisational answer, and it can cover more than one statement.
What it is for
- One way of working. The same access process can satisfy several statements. You describe it once and link the statements.
- Ownership. Accountable, responsible, consulted, and informed are named, not implied.
- A cadence. Monitoring frequency says how often it should be checked. Tests record whether it was.
- A result. Effectiveness comes from those tests and from whether the evidence is still in date.
How coverage uses them
In-scope statements are the ones you have not marked out of scope. A statement is covered when at least one implemented control is linked to it. Effectiveness of that statement depends on every control linked to it, not on a single pass.
How ISMSVision helps with implemented controls is the product. The Implemented controls category explains the register and each part of the record.