Everything you need to know
Security and customers first

Request a demo

Find out today the difference that Hicomply’s unique solution can make to your business.


Thank you for your request


In the meantime, connect with Hicomply for insights on authentication and fraud prevention


ROI Calculator

See how much you could save with Hicomply

Hicomply feature Yearly saving
Automated scoping Easily scope your ISMS with the Hicomply platform
Asset register autogeneration A shorter learning curve for organisations and a simplified process
Risk assessment Autogenerate your risk register and risk treatment plan
Extended policy templates 90% of the essential are already written out of the box
Controls framework All controls are pre-loaded and already linked to the risks they mitigate
Task management Automate all actions, administration and setup time of your ISMS
Real time monitoring Understand status and progress across your ISMS with the Hicomply dashboard
Compliance & Training Your whole team, on the same page
Audit readiness Hicomply makes sure you have everything in place for your audit
Auditor access Give auditors a dedicated login to access and audit your ISM
Back to Resource Hub

ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation

The role of this clause is to evaluate the information security performance by monitoring and measuring data security activities, and the efficiency of the ISMS of the organisation.

For evaluation of these processes, procedures, and functions that are protecting the intended information, the organisation must decide which processes and activities must be monitored and measured including the information security processes and controls established within the scope of ISMS. Methods must be determined by the organisation to monitor, measurement, evaluation and analysis to ensure the outcome will be valid. The selected method should give reliable and comparable results every time.

The organisation must decide when this monitoring and measuring happen. It can be performed at different intervals determined by the organisation. These intervals are different for every organisation as they depend upon the size or type of organisation. Who will be monitoring and measuring should also be determined by the organisation. After the monitoring and measuring, the organisation must determine how these results can be evaluated or by whom they will be evaluated and analysed.

All the related documents must be kept in documentation form.

More Resource Hub

NIST Controls For Supply Chain Risk Management
ISO 9001 Hub
NIST 800-53 Hub