ISO 27001 clauses
Clause 9 asks one question: how do you know?
An ISMS can look complete and still be failing quietly. Clause 9 makes you measure it, audit it and have leadership review it, so problems surface before a customer or an attacker finds them. It has three parts: monitoring and measurement, the internal audit, and the management review. This page covers the first in depth and shows how the other two fit.
Back to ISO 27001 services01 · Decisions to make
Six decisions clause 9.1 leaves to you
The standard asks you to decide them, write them down, and then keep to them.
- What
- Which processes and controls you will watch. Not everything: the ones whose failure would hurt most.
- How
- The method, chosen so that repeated measurements can be compared and produce valid results.
- When
- How often each measure is taken.
- Who measures
- The role responsible for producing the number.
- When it is analysed
- Taking a number is not the same as looking at it. Set a point when results are interpreted.
- Who analyses
- Often a different person from the one who measured, so trends are judged with some distance.
The standard asks you to evaluate both information security performance and the effectiveness of the ISMS itself. The first tells you whether controls work; the second tells you whether the system that manages them is doing its job.
02 · Meaning vs vanity
Metrics that mean something, and numbers that only look busy
A good metric changes a decision. A vanity number only fills a slide.
Meaningful
- Ties to a risk or an objective you set under clause 6.2
- Has a target or threshold, so a bad result is obvious
- Moves when the control gets better or worse
- Has an owner who can act on it
Vanity
- Counts activity, such as emails blocked or alerts generated
- Always goes up, whatever happens
- No one knows what a bad value would be
- Reported, never discussed
Blocked phishing emails is a vanity number. The share of staff who reported a simulated phish within an hour tells you whether training works.
03 · A metrics starter set
A starter set of measures
Illustrative. Pick the few that match your risks and fill in the frequency yourself.
| Metric | What it tells you | Owner | Review frequency |
|---|---|---|---|
| Leavers with access removed within the policy window | Whether offboarding actually closes doors | IT or identity lead | |
| Critical vulnerabilities fixed within target | Whether patching keeps pace with exposure | Engineering lead | |
| Restore tests passed on first attempt | Whether backups would work when needed | Infrastructure owner | |
| Access reviews completed on schedule | Whether privilege creep is being caught | System owners | |
| Risk treatment actions overdue | Whether the treatment plan is moving | ISMS lead | |
| Corrective actions closed and verified | Whether findings are fixed, not just marked done | ISMS lead | |
| Security objectives on track | Whether the ISMS is delivering what leadership asked for | Top management | |
| Suppliers reviewed against plan | Whether outsourced risk is being watched | Procurement or vendor owner |
Keep the results as documented information. A dashboard screenshot with a date, or a monthly export, is usually enough evidence.
04 · Audit and review
The two formal loops: internal audit and management review
Measurement runs all the time. These two happen at planned intervals and carry the most weight with an auditor.
9.2 Internal audit
Does the ISMS conform, and is it working?
An objective check against the standard and your own rules, run as a planned programme. Our internal audit guide covers auditors, sampling and how to write findings.
9.3 Management review
Is the ISMS still right for the business?
Top management looks at results, changes and risks, then decides on improvements and resources. Our management review guide gives an agenda and the inputs it needs.
The order matters. Metrics feed the audit, the audit feeds the review, and the review produces decisions that change what you measure next time.
05 · Into improvement
How results turn into change
Evaluation without action is just reporting.
- A metric misses its threshold, an audit raises a finding, or a review spots a trend.
- If a requirement is not met, it becomes a nonconformity and goes through corrective action under clause 10.2.
- If it is a chance to do better, it becomes an improvement item under clause 10.1.
- Either way, an owner, a due date and an effectiveness check are recorded.
- The next review looks at whether the change worked.
06 · Mistakes
Common clause 9 mistakes
Most of them come from measuring to satisfy the auditor rather than to run the business.
- Dozens of metrics, no thresholds. Nothing ever turns red, so nothing is ever acted on.
- Measuring only what is easy. Tool counts are easy; the questions that matter usually need a little manual work.
- No analysis step. Numbers are collected monthly and read once a year.
- Metrics disconnected from objectives. The objectives say one thing and the measures track another.
- Audit and review held back to back, just before the certification audit. There is no time to act on what they find.
Sources: ISO/IEC 27001:2022, clause 9 (performance evaluation) with sub-clauses 9.1, 9.2 and 9.3, and clauses 6.2 and 10, described in our own words.
Questions about performance evaluation
How many metrics does ISO 27001 require?
No number. Enough to judge performance and effectiveness.
The standard sets no count. A small organisation can do well with six to ten measures tied to its main risks and objectives. More measures are only useful if someone analyses them.
Must the metrics have targets?
Not by name, but evaluation is hard without them.
Clause 9.1 asks you to evaluate performance. Without a threshold you cannot say whether a result is good or bad, so in practice most auditors expect to see one, especially for metrics linked to your security objectives.
Does a GRC tool's dashboard satisfy clause 9.1?
Only if the decisions behind it are made and recorded.
A dashboard can hold the numbers. You still need to show what you chose to measure and why, who analyses results, and what happened when a measure went off track.
Is the internal audit part of clause 9?
Yes, it is clause 9.2.
Clause 9 has three parts: monitoring and measurement (9.1), the internal audit (9.2) and the management review (9.3). Each has its own records, and each is sampled at certification and surveillance audits.
Measure what changes your decisions.
An ISO 27001 gap analysis reviews your metrics, audit programme and management review against clause 9.