Control 9.1Monitoring, measurement, analysis and evaluation
Determine what needs to be monitored and measured — including information security processes and controls — the methods to be used, when the monitoring and measuring is performed, and when the results are analysed and evaluated, and by whom in each case. The methods must produce comparable and reproducible results to be considered valid. Results are retained as documented information, and the organisation must evaluate the information security performance and the effectiveness of the ISMS.
The word that decides whether this clause is met is effectiveness. Counting activity — patches applied, tickets closed, training completed — measures whether controls operated, not whether they worked. Effectiveness asks whether the risk the control was chosen to treat is actually being treated.
“Comparable and reproducible” rules out measures whose definition shifts between periods, which is the quiet reason many security metrics show improvement. A measure that changed its denominator has not measured an improvement.
How to put this in place
If you do not measure the ISMS you cannot say whether it works. Measures defined but never analysed are a regular finding.
- Decide what to measure, how, when, and who analyses it.
- Link measures to objectives, risks and controls.
- Collect the data on schedule.
- Analyse and evaluate the results, and write down conclusions.
- Report to top management and act on the results.
Evidence an auditor usually looks for: a measurement plan and periodic reports showing analysis, with evidence of who reviewed them.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 4 (Implement and operate) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-13: the typical form, what auditors accept instead and the gaps they reliably find.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.