Clause 9.1 Monitoring, measurement, analysis and evaluation
Clause 9.1 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Monitoring, measurement, analysis and evaluation. The organization must determine what is to be monitored and measured, including security processes and controls; which methods of monitoring, measuring, analysing and evaluating will give valid results (comparable and reproducible methods are considered valid); when monitoring and measurement are done; who does them; when results are analysed and evaluated; and who does that analysis and evaluation. Documented information must be available as evidence of results, and the organization must judge how well it performs on security and how effective the ISMS is.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 9.1 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 9), in our words, not a statement of the standard and not binding on an assessor.
- A measurement plan listing what is measured, methods, frequency, responsibilities and when and by whom results are analysed
- Metric results for processes and controls over time
- Analysis and evaluation reports on security performance and ISMS effectiveness
- Evidence the results fed management review