ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation (2022)

The role of this clause is to evaluate the information security performance by monitoring and measuring data security activities, and the efficiency of the organisation’s ISMS.

For evaluation of these processes, procedures and functions that are protecting the intended information, the organisation must decide which processes and activities must be monitored and measured. This includes the information security processes and controls established within the scope of ISMS.

Methods must be determined by the organisation to monitor, measure, evaluate and analyse, all to ensure the outcome will be valid. The methods selected should produce comparable and reproducible results to be considered valid.

The organisation must decide when this monitoring and measuring happen. It can be performed at different intervals determined by the organisation. These intervals are different for every organisation, as they depend upon the size and type of organisation. Senior leadership, or whoever is responsible for the ISMS, should determine who is responsible for the monitoring and measuring process on an ongoing basis.

After each iteration of the monitoring and measurement process, the organisation must determine how the results gathered can be evaluated or by whom they will be evaluated and analysed.

All the related documents must be kept in documentation form, and the organisation should use this evidence to evaluate the information security performance and the effectiveness of the information security management system.