About
Close

Request a demo

Find out today the difference that Hicomply’s unique solution can make to your business.

Close

Thank you for your request

Success

In the meantime, connect with Hicomply for insights on authentication and fraud prevention

Back to Resource Hub

ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation

The role of this clause is to evaluate the information security performance by monitoring and measuring data security activities, and the efficiency of the ISMS of the organisation.

For evaluation of these processes, procedures, and functions that are protecting the intended information, the organisation must decide which processes and activities must be monitored and measured including the information security processes and controls established within the scope of ISMS. Methods must be determined by the organisation to monitor, measurement, evaluation and analysis to ensure the outcome will be valid. The selected method should give reliable and comparable results every time.

The organisation must decide when this monitoring and measuring happen. It can be performed at different intervals determined by the organisation. These intervals are different for every organisation as they depend upon the size or type of organisation. Who will be monitoring and measuring should also be determined by the organisation. After the monitoring and measuring, the organisation must determine how these results can be evaluated or by whom they will be evaluated and analysed.

All the related documents must be kept in documentation form.

More Resource Hub

ISO27001
SOC 2 Type 1 vs SOC 2 Type 2
ISO27001
SOC 2 Compliance Checklist (2022)
ISO27001
SOC 2 Report Types