ISO 27001:2022 Requirements: Clause 9.1 Monitoring, Measurement, Analysis and Evaluation

The role of this clause is to evaluate the information security performance by monitoring and measuring data security activities, and the efficiency of the organisation’s ISMS.

{{snapshot}}

Clause 9.1 at a glance

• Clause 9.1 evaluates information security performance by monitoring and measuring the efficiency of the ISMS.
• The organisation decides which processes and activities to monitor — the controls within the ISMS scope.
• Chosen methods must produce comparable, reproducible and valid results.
• It sets the intervals for monitoring and names who is responsible, as part of the wider ISO 27001 requirements.

{{/snapshot}}

For evaluation of these processes, procedures and functions that are protecting the intended information, the organisation must decide which processes and activities must be monitored and measured. This includes the information security processes and controls established within the scope of ISMS.

Methods must be determined by the organisation to monitor, measure, evaluate and analyse, all to ensure the outcome will be valid. The methods selected should produce comparable and reproducible results to be considered valid.

The organisation must decide when this monitoring and measuring happen. It can be performed at different intervals determined by the organisation. These intervals are different for every organisation, as they depend upon the size and type of organisation. Senior leadership, or whoever is responsible for the ISMS, should determine who is responsible for the monitoring and measuring process on an ongoing basis.

After each iteration of the monitoring and measurement process, the organisation must determine how the results gathered can be evaluated or by whom they will be evaluated and analysed.

{{snapshot}}

Turning data into evidence

• After each cycle, decide how and by whom the results are evaluated and analysed.
• Keep all related documents in documented form as evidence.
• Use that evidence to judge information security performance and ISMS effectiveness; see related clauses in the ISO 27001 hub.

{{/snapshot}}

All the related documents must be kept in documentation form, and the organisation should use this evidence to evaluate the information security performance and the effectiveness of the information security management system.

{{snapshot}}

From the Hicomply team

Monitoring only earns its keep when the numbers are trustworthy and always to hand. Rather than pulling metrics together for each review, capture them continuously so trends in performance surface early and evidence is ready the moment an auditor asks. Our platform tour shows how, and you can try our free compliance tools to get started.

{{/snapshot}}