Monitoring, measurement, analysis and evaluation

Plain-language summary

Deciding what you will measure to know whether the ISMS and its controls work — with methods that give repeatable results, set times, named people — then analysing the numbers and keeping them as evidence.

What the clause is really asking

You cannot manage what you do not measure, and this clause turns measurement into a system rather than a habit. The organisation decides what it will monitor and measure — its information security processes and controls among them; how it will monitor, measure, analyse and evaluate, in ways that give valid results (the text adds that comparable and reproducible results are what make them valid); when measuring happens and who does it; and when the results are analysed and evaluated, and by whom. There must be documented evidence of the results, and the organisation has to judge both how well it is performing on information security and whether the ISMS is effective. Good ISMS metrics are few and operational: patch latency against policy, percentage of privileged accounts on MFA, backup restore-test success, access reviews completed on time, phishing-report rate, incidents by cause, supplier reviews overdue, objectives on track. The point of the clause is to make 'is the ISMS effective?' a question answered with data at management review, not with a feeling. Missing or decorative metrics are a frequent ISO 27001 audit finding.

What auditors look for

Auditors ask what you measure, why those things, and what the latest results say. They test the method — would two people measuring this get the same number? — and the cadence — was it measured when the plan said? They look for metrics tied to controls in the SoA and to the objectives in 6.2, for analysis (trend, cause, decision) rather than raw numbers, and for the results reaching management review. A dashboard that exists but was never discussed, or metrics that are all green while incidents and audit findings tell another story, draws questions.

Typical evidence

Measurement register or plan: what, method, frequency, who measures, who analyses; KPI results over time (dashboards, reports); analysis and evaluation records (commentary, trends, decisions); management-review minutes showing results discussed; evidence that metrics cover both processes and controls and link to objectives.

How to comply — recommendations

Choose eight to twelve measures, each tied to a control or an objective, and write a one-line method for each so the number is reproducible from the system that generates it. Set the cadence (monthly for operational controls, quarterly for programme measures), name the measurer and the analyst, and put a dated commentary beside each result — what it says, what you will do. Review the set annually; drop measures nobody acts on. Present the trend page at every management review. The ISMS Metrics, Management Review and Evidence Tracker on the Templates page carries this register.

Common nonconformities

No defined set of ISMS measures, or measures of activity only (training delivered) with none of effectiveness; methods not reproducible; measurements not made at the planned frequency; results not analysed or evaluated, only collected; results not documented; metrics not discussed at management review; no metrics for control effectiveness.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.