Monitoring, measurement, analysis and evaluation
The organization must determine what is to be monitored and measured, including security processes and controls; which methods of monitoring, measuring, analysing and evaluating will give valid results (comparable and reproducible....
What the requirement asks
The organization must determine what is to be monitored and measured, including security processes and controls; which methods of monitoring, measuring, analysing and evaluating will give valid results (comparable and reproducible methods are considered valid); when monitoring and measurement are done; who does them; when results are analysed and evaluated; and who does that analysis and evaluation. Documented information must be available as evidence of results, and the organization must judge how well it performs on security and how effective the ISMS is.
What the guidance adds
Monitoring is expected to answer what, how, when and who, and then to show the analysis and the decision. The guidance asks for measures that inform the system, not measures that flatter it. A dashboard with no owner and no action is not monitoring.
Status of the guidance. The guidance lens for 9.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep A measurement plan listing what is measured, methods, frequency, responsibilities and when and by whom results are analysed with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Performance measurementA measurement plan listing what is measured, methods, frequency, responsibilities and when and by whom results are analysed
- Performance measurementMetric results for processes and controls over time
- Performance measurementAnalysis and evaluation reports on security performance and ISMS effectiveness
- Performance measurementEvidence the results fed management review
The question an assessor will ask
An assessor will ask for A measurement plan listing what is measured, methods, frequency, responsibilities and when and by whom results are analysed. The test for 9.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Metrics are collected but never analysed or evaluated
- Methods are not repeatable, so results cannot be compared
- Measurements cover activity counts rather than control effectiveness
- Responsibilities for measurement are unassigned
Before the next audit
Before the next audit, test this against one live record: metrics are collected but never analysed or evaluated.