This version of clause 9.1 is applicable to both ISO 27001:2022 and ISO 27001:2013.

The role of this clause is to evaluate the information security performance by monitoring and measuring data security activities, and the efficiency of the ISMS of the organisation.

For evaluation of these processes, procedures, and functions that are protecting the intended information, the organisation must decide which processes and activities must be monitored and measured including the information security processes and controls established within the scope of ISMS. Methods must be determined by the organisation to monitor, measurement, evaluation and analysis to ensure the outcome will be valid. The methods selected should produce comparable and reproducible results to be considered valid.

The organisation must decide when this monitoring and measuring happen. It can be performed at different intervals determined by the organisation. These intervals are different for every organisation as they depend upon the size or type of organisation. Who will be monitoring and measuring should also be determined by the organisation. After the monitoring and measuring, the organisation must determine how these results can be evaluated or by whom they will be evaluated and analysed.

All the related documents must be kept in documentation form, and the organisation should evaluate the information security performance and the effectiveness of the information security management system.