Monitoring and measurement

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization must determine what is to be monitored and measured, including security processes and controls; which methods of monitoring, measuring, analysing and evaluating will give valid results (comparable and reproducible methods are considered valid); when monitoring and measurement are done; who does them; when results are analysed and evaluated; and who does that analysis and evaluation. Documented information must be available as evidence of results, and the organization must judge how well it performs on security and how effective the ISMS is.

How the 2020 guidance taught the audit

Auditors confirm that the organization evaluates information security performance and ISMS effectiveness and has defined what is monitored and measured (qualitatively and quantitatively, including processes and controls), the methods that ensure valid results, when monitoring and measurement happen and who does them, and when and by whom results are analysed and evaluated. They review performance through documented information such as plans, reports to top management, management review results, internal audit reports and reports of information security events, weaknesses and incidents. They evaluate how nonconformities, processing errors, incidents and other events are anticipated, detected, reported and handled, and how the organization judges whether risk treatment worked and whether the controls chosen for it are implemented and operating effectively. They check that the evaluation feeds continual improvement, that changes it indicates reach risk assessment and treatment, that documented information on risk actions is updated, that the attributes monitored are necessary and sufficient to judge how far planned ISMS activities are realised and outcomes achieved, and that results go to top management through management review. Where ISO/IEC 27004 is followed, terms such as performance measures and effectiveness measures may be used.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

No substantive change. The clause still requires the what, how, when and who of monitoring, and the analysis and evaluation of the results.

Evidence an auditor asks for

• Performance evaluationMeasurement plan stating what, how, when and by whom things are monitored, measured, analysed and evaluated
• Performance evaluationPerformance reports to top management and management review results
• Performance evaluationReports of information security events, weaknesses and incidents
• Performance evaluationEvidence of evaluations of control effectiveness and of risk treatment
• Performance evaluationStatus reports on objectives and the risk treatment plan

The questions an auditor will ask

Ask what is measured, how the measure is defined and what decision the result changed.

Common gaps

• Measures defined but not sufficient to judge whether the ISMS achieves its outcomes
• Results collected but never analysed or reported
• Incident and weakness reports not used in the evaluation
• Control effectiveness assumed rather than measured

Prepare before the next audit

Define each measure, its source, its frequency and its owner. Test one result against the source.

Cross-references