For the Measured domain, evidence must exist that controls are being evaluated for effectiveness.

Without documentation, a control cannot be measured, as there is no evidence of monitoring or review activity.

Documentation is the basis for determining repeatability, maturity, and strength in the scoring model.

Extract Reference (HITRUST Scoring Methodology [0126]):

If a control is undocumented, it cannot be evaluated in the Measured domain, as measurement requires documentation of monitoring.