The role of this clause is to evaluate the information security performance by monitoring and measuring data security activities, and the efficiency of the ISMS of the organisation.
For evaluation of these processes, procedures, and functions that are protecting the intended information, the organisation must decide which processes and activities must be monitored and measured including the information security processes and controls established within the scope of ISMS. Methods must be determined by the organisation to monitor, measurement, evaluation and analysis to ensure the outcome will be valid. The selected method should give reliable and comparable results every time.
The organisation must decide when this monitoring and measuring happen. It can be performed at different intervals determined by the organisation. These intervals are different for every organisation as they depend upon the size or type of organisation. Who will be monitoring and measuring should also be determined by the organisation. After the monitoring and measuring, the organisation must determine how these results can be evaluated or by whom they will be evaluated and analysed.
All the related documents must be kept in documentation form.
