Clause 9 : Performance Evaluation

Requirement
The organisation must determine what needs to be monitored and measured, including information security processes and controls, the methods to use, when monitoring and measurement are performed, who is responsible, when results are analysed and evaluated, and who does that analysis. Documented information must be available as evidence of results. The organisation must evaluate both information security performance and the effectiveness of the ISMS.

How to Implement
Define a small set of meaningful security metrics, for example, number of incidents per quarter, percentage of systems patched within SLA, or phishing simulation click rates. For each metric, assign a method, a frequency, and an owner. Review these metrics regularly, whether monthly or quarterly, and feed the results into management review. Since tracking too many metrics dilutes focus, a handful of well-chosen ones beat dozens of vanity numbers.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states that “documented information shall be available as evidence of the results.” You must keep:

• Records of your monitoring and measurement results, however they are presented, such as dashboards, reports, or spreadsheets

Requirement
Under 9.2.1 (General), the organisation must conduct internal audits at planned intervals to check whether the ISMS conforms to the organisation’s own requirements and to the standard’s requirements, and whether it is effectively implemented and maintained.

Under 9.2.2 (Internal Audit Programme), the organisation must plan, establish, implement, and maintain an audit programme covering frequency, methods, responsibilities, planning requirements, and reporting, considering the importance of the processes involved and results of previous audits. It must define audit criteria and scope for each audit, select auditors who ensure objectivity and impartiality, and ensure audit results are reported to relevant management.

How to Implement
Build an annual internal audit schedule covering every clause and every Annex A control area over a defined audit cycle, commonly spread over one to three years depending on ISMS size. Appoint auditors who are independent of the area they are auditing; this can be a trained internal staff member from another department, or an external consultant for smaller organisations. For each audit, define scope and criteria beforehand, conduct interviews and evidence review, and produce a findings report that goes to top management.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states that “documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.” You must maintain:

• An Internal Audit Programme or Schedule
• Internal Audit Reports, including findings and any nonconformities raised

Requirement

Requirement
Under 9.3.1 (General), top management must review the ISMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness.

Under 9.3.2 (Management Review Inputs), the review must consider the status of actions from previous reviews, changes in external and internal issues, changes in interested party needs, feedback on security performance (including nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfilment of objectives), feedback from interested parties, risk assessment results and risk treatment plan status, and opportunities for continual improvement.

Under 9.3.3 (Management Review Results), the results must include decisions related to continual improvement opportunities and any needed changes to the ISMS.

How to Implement
Schedule management reviews at least annually, more often for newer or less mature ISMSs. Prepare an agenda covering every input listed above, and ensure top management actually attends and participates rather than rubber-stamping a report. Document the discussion and, most importantly, the decisions made, such as changes to the policy, resourcing, objectives, or risk treatment plan, then assign owners and deadlines for any follow-up actions.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states that “documented information shall be available as evidence of the results of management reviews.” You must keep:

• Management Review Minutes or Records, covering the inputs discussed and the decisions made at each review