Solutions The best route to security compliance
Platform A powerful suite of ISMS features
Resources Everything you need to know
Knowledge Base Learn more about infosec
Company Security and customers first

ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation (2022)

This version of clause 9.1 is applicable to both ISO 27001:2022 and ISO 27001:2013, and details the need to continually monitor and measure the effectiveness of the information security management system.

The role of this clause is to evaluate the information security performance by monitoring and measuring data security activities, and the efficiency of the organisation’s ISMS.

For evaluation of these processes, procedures and functions that are protecting the intended information, the organisation must decide which processes and activities must be monitored and measured. This includes the information security processes and controls established within the scope of ISMS.

Methods must be determined by the organisation to monitor, measure, evaluate and analyse, all to ensure the outcome will be valid. The methods selected should produce comparable and reproducible results to be considered valid.

The organisation must decide when this monitoring and measuring happen. It can be performed at different intervals determined by the organisation. These intervals are different for every organisation, as they depend upon the size and type of organisation. Senior leadership, or whoever is responsible for the ISMS, should determine who is responsible for the monitoring and measuring process on an ongoing basis.

After each iteration of the monitoring and measurement process, the organisation must determine how the results gathered can be evaluated or by whom they will be evaluated and analysed.

All the related documents must be kept in documentation form, and the organisation should use this evidence to evaluate the information security performance and the effectiveness of the information security management system.