Key takeaways
- Decide what to measure, how, when, and who analyses the results.
- You cannot manage what you do not measure.
- Start here: decide what to monitor and measure.
Purpose
Decide what to measure, how, when, and who analyses the results.
Requirement
Requirement summarya) what needs to be monitored and measured, including information security processes and controls; b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results. The methods selected should produce comparable and reproducible results to be considered valid; c) when the monitoring and measuring shall be performed; d) who shall monitor and measure; e) when the results from monitoring and measurement shall be analyzed and evaluated; f) who shall analyze and evaluate these results. Documented information shall be available as evidence of the results. The organization shall evaluate the information security performance and the effectiveness of the information security management system.
Why it matters
You cannot manage what you do not measure. Metrics show whether the ISMS is working.
How to implement
- Decide what to monitor and measure.
- Define methods, frequency and who analyses results.
- Collect and evaluate data.
- Report results to management.
What evidence you need to provide
Here is what you will typically need to provide for Clause 9.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A list of what you measure: what, how, when, who measures and who reviews the results.
Records and examples to show
- Measurement results such as dashboards or monthly reports.
- Proof results were reported at management review.
Things you should be able to show or explain
- Be able to explain what a result means and what was done about it.
How much to show: A few key measures and their latest results.
Common mistakes
- Measures that don't show anything useful.
- Results never reviewed.
- Metrics that do not relate to objectives.
- Data collected but never analysed.
- Tip: Do a full internal audit and a management review before your Stage 2 audit.
Policies & documents to have
- Information security objectives plan
- Human Resource Security Policy
FAQ
Can we exclude clause 9.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Meaningful metrics that are reviewed.