ISO 27001 Clause 9.1 — Monitoring, measurement, analysis and evaluation
Six questions to answer before you measure anything, and the obligation that turns measurement into evaluation
Clause 9.1 requires the organisation to determine what needs monitoring and measuring — including information security processes and controls — the methods, when monitoring and measuring is performed, who performs it, when the results are analysed and evaluated, and who analyses and evaluates them. Documented information must be available as evidence of the results.
📌 Quick navigation
What the clause asks for
Six determinations, and they split into two halves that are easy to conflate: the collection half (what, how, when, by whom) and the analysis half (when analysed, by whom). Organisations routinely close the first and leave the second implicit, and that is the usual finding.
On method, the standard adds a qualification worth reading twice: the methods selected should produce comparable and reproducible results to be considered valid. A metric that changes meaning between periods is not evidence of anything.
The clause ends with the obligation that gives it its point: the organisation shall evaluate the information security performance and the effectiveness of the ISMS. Collecting numbers is not compliance; forming a judgement from them is.
What it looks like in practice
| Determination | What a complete answer looks like |
|---|---|
| What to monitor and measure | Named items, including specific processes and specific controls — not a vague intention to monitor security. |
| Methods | How each is obtained, defined tightly enough that two people would get the same number. |
| When measured | A stated frequency per item — continuous, monthly, quarterly. |
| Who measures | A named role, not a department. |
| When analysed and evaluated | A stated point at which the numbers are turned into a judgement. |
| Who analyses and evaluates | A named role, ideally not the same person who produced the number. |
A single table with six columns satisfies this clause completely, and it is far more durable than a metrics policy. One row per measure; if a row has an empty cell, that is the gap the auditor will find.
Distinguish clearly between measuring a control and measuring the ISMS. “Patches applied within SLA” tells you about a control; “risks reduced to acceptable levels within the planned timeframe” tells you about the system. The standard asks you to evaluate both.
Resist the metric that is easy to collect and says nothing. Counting training completions is cheap; measuring whether reported phishing rates improved is the one that actually informs a decision.
What an auditor will want to see
- A documented monitoring and measurement plan covering all six determinations.
- The measurement results themselves, retained over time.
- Evidence of evaluation — analysis, conclusions, decisions — not only of collection.
- Comparable results across periods, demonstrating methods that are reproducible.
- Results feeding management review under clause 9.3, which requires monitoring and measurement results as an explicit input.
- Evidence that poor results led to action rather than to a footnote.
Where it usually goes wrong
| Pattern | Why it fails |
|---|---|
| Measurement without evaluation | Dashboards full of numbers and no recorded judgement about what they mean. The clause requires evaluation explicitly. |
| Only the easy metrics | Measuring what the tooling reports rather than what matters. Common, and it produces a compliant plan that informs nothing. |
| Methods that are not reproducible | A metric defined loosely enough that its meaning drifts. The standard says methods should produce comparable and reproducible results. |
| Analysis roles unassigned | Who collects is defined; who evaluates is not. The clause names both. |
| Results that never reach management | Measurement is an explicit input to management review. Numbers that stay in the security team do not satisfy that. |
Frequently asked questions
How many measures do we need?
No number is set. Enough to evaluate information security performance and ISMS effectiveness honestly. Six to twelve well-chosen measures usually beat thirty automatic ones.
Is a SIEM dashboard enough?
It can supply data for the collection half. It does not supply the evaluation, the named roles or the analysis schedule the clause also requires.
What is the difference between monitoring and measurement?
Monitoring is watching something over time; measurement is assigning a value to it. The clause requires both, and the standard treats them together.
Does this replace internal audit?
No. Measurement tells you how things are performing; internal audit tells you whether the ISMS conforms and is effectively implemented. Different questions, different clauses.
Choosing measures that inform decisions rather than fill a report is the hard part. Contact us if you want a second opinion on yours.
Where this sits
This page explains the requirement in our own words, for study and orientation. It is not a substitute for the standard: the authoritative text is ISO/IEC 27001:2022, available from ISO and from national standards bodies.
