How do we decide what to monitor and measure in our ISMS, and who evaluates it?

Start

We must show we monitor and measure the ISMS

The auditor wants to see that you know whether the ISMS works, from measures that were defined, collected and read. The pack's checklist lists the results of monitoring and measurement as a required record: a measurement plan and the periodic reports.

• Then: Does each objective have a measure, an owner and a target?

Decision

Does each objective have a measure, an owner and a target?

Objectives that cannot be measured cannot be monitored. The pack asks for objectives with a measure, a target, an owner, the resources, a date and how results will be evaluated. If any lacks one of these, answer no.

• Yes: Pick the controls and processes whose effectiveness you will check
• No, or not known: Add the missing measure, owner or target

Step

Add the missing measure, owner or target

Go back to the objectives and give each what it lacks. An objective measured as 'better security' will fail the first question an auditor asks.

• Then: Pick the controls and processes whose effectiveness you will check

Step

Pick the controls and processes whose effectiveness you will check

Take the ones that treat your biggest risks and the blocking items the pack names, such as the risk assessment, the internal audit programme and the management review. Check whether the control works, for example by sampling its records, not only whether it exists.

• Then: Keep the set small enough that someone reads every figure

Step

Keep the set small enough that someone reads every figure

The pack's own headline set has four measures, reported monthly. A handful that are read and acted on beats a long list that nobody opens. Drop a measure that informs no decision.

• Then: Can you collect each figure from records you already keep?

Decision

Can you collect each figure from records you already keep?

A measure that needs new tooling or a manual count each month tends to lapse. Prefer a figure from tickets, logs, trackers or registers. If a figure needs something you do not have, answer no.

• Yes: Would two people collecting it get the same figure?
• No, or not known: Choose a measure you can collect, or add the cheapest source

Step

Choose a measure you can collect, or add the cheapest source

Replace the measure with one you can collect from existing records, or add the smallest source that gives the figure. Do not keep a measure you cannot collect regularly: gaps in the series are the first thing an auditor sees.

• Then: Would two people collecting it get the same figure?

Decision

Would two people collecting it get the same figure?

Methods should give comparable and reproducible results, or the trend means nothing. Write the source, the filter and the period, so the figure does not move with whoever collects it. If you are not sure, answer no.

• Yes: Write the plan: measure, method, frequency, collector, analyst
• No, or not known: Write the definition: source, filter, period

Step

Write the definition: source, filter, period

One line per measure is enough. See the metric question for the form. Include what counts as an event, from which system, and over which period.

• Then: Write the plan: measure, method, frequency, collector, analyst

Step

Write the plan: measure, method, frequency, collector, analyst

The pack's checklist describes the plan as what is measured, how, when, and who analyses it, plus the periodic reports. Name the person who collects and the person who analyses and evaluates. They may be the same in a small team, but the evaluation must be recorded. Choose an analyst who understands the control and can act on the figure, often the process owner. The ISMS manager reads across the set and top management evaluates the whole in the review.

• Then: Decide where results go

Step

Decide where results go

Send results to the ISMS manager on a regular cycle, and show trends over recent periods in the management review. The review pack asks for monitoring and measurement results against targets, as trends, from the measure owners.

• Then: Collect on schedule and keep the results

Step

Collect on schedule and keep the results

Records over the operating period are what the auditor samples, so missing months are a problem. Keep the raw figure, the date and who collected it.

• Then: Did any measure miss its target or trend the wrong way?

Decision

Did any measure miss its target or trend the wrong way?

Evaluation means reading the result and deciding what it means. If a measure missed, the auditor will ask what was done. If you have not read the results, answer yes and read them.

• Yes, or not known: Record the decision; log a nonconformity if a requirement is missed
• No: Record the conclusion anyway

Step

Record the decision; log a nonconformity if a requirement is missed

A miss may need no action, a change to the target, a new control or a corrective action. Write which, with the reason. If a requirement of the standard or your own policy is not met, log it as a nonconformity.

• Then: Put the trends in the management review pack

Step

Record the conclusion anyway

'Acceptable, no action' is a conclusion, but it must be written down with the date and the person. An evaluation nobody recorded looks like no evaluation.

• Then: Put the trends in the management review pack

Step

Put the trends in the management review pack

Include the results as trends over several periods, with the measure owner's reading. Top management then decides what needs action, and the minutes become evidence of evaluation.

• Then: Measures defined, collected, evaluated and read

Outcome

Measures defined, collected, evaluated and read

Review the plan at each management review: drop measures nobody used and add one where a decision lacked a figure. Do not describe the measures as proof that the ISMS is effective. They are the evidence on which the review forms its view.