ISO 27001 Clause 9: Evaluate ISMS Performance

What clause 9 requires in practice

Clause 9 is how the organisation finds out whether its ISMS works. It has three requirements that feed one another.

• Monitoring, measurement, analysis and evaluation: decide what to monitor, by which methods, when, and by whom, then evaluate security performance and the effectiveness of the system.
• Internal audit: audits at planned intervals, run through a programme, tell the organisation whether the system conforms to its own requirements and to the standard, and whether it is effectively implemented.
• Management review: top management reviews the ISMS at planned intervals, considering defined inputs and making decisions about improvement and change.

Each item has documented evidence expected. The outputs are trustworthy performance information, independent assurance and informed leadership decisions. The standard does not prescribe particular measures, audit schedules or meeting formats.

9.1: measure something that can support a decision

The organisation determines what it needs to monitor and measure, including security processes and controls; the methods, timing and responsibilities; and how and when results will be analysed and evaluated. Methods need to produce valid results, with comparability and reproducibility where relevant. Documented evidence of results is retained. The overall purpose is to evaluate information security performance and ISMS effectiveness.

As an original example, a software business reports that nearly every employee completed security learning. A product team nevertheless keeps granting temporary production access without removing it. The completion figure answers a learning-administration question. A sample of access expiry, overdue removal and exceptions addresses the actual control concern. Both measures can be useful, but they should not be presented as interchangeable evidence of effectiveness.

Define the population and denominator before reporting a percentage. Ten unresolved high-impact accounts can disappear behind a large number of routine low-risk changes. Also examine why performance moved: a better detection process may initially increase reported incidents without representing deteriorating security.

9.2: examine conformity and operation objectively

Internal audit takes place at planned intervals and evaluates conformity with the organisation's own ISMS requirements and the standard, alongside effective implementation and maintenance. Clause 9.2.2 addresses the programme: frequency, methods, responsibilities, planning and reporting, taking account of process importance and previous audit results. Each audit needs defined criteria and scope, impartial and objective conduct, reporting to relevant management, and documented evidence of the programme and results.

Consider a hypothetical BPO operation serving several customers. An audit follows one customer-data export from approval to secure transfer and deletion. It compares actual conduct with contractual commitments, the organisation's process and applicable ISMS requirements. Interviewing the manager alone would miss the employee's workaround and the supplier's retained copy. Sampling should be explained; one successful transaction does not establish that every transaction succeeds.

A small organisation can use an appropriately independent external auditor or cross-functional arrangements. The practical question is whether the chosen arrangement preserves objectivity and competence. The internal audit guide examines programme design and evidence trails in greater detail.

9.3: turn evaluation into management decisions

Management review occurs at planned intervals to consider continuing suitability, adequacy and effectiveness. Required inputs include previous actions; changes in relevant context and interested-party requirements; performance trends covering nonconformities, corrective actions, measurement, audits and objectives; feedback; risk assessment results and treatment status; and improvement opportunities. Review outputs include decisions on improvements and any needed ISMS changes, with documented evidence of results.

A manufacturing group might find that supplier remote access is managed well at headquarters but poorly during overnight maintenance at two factories. The useful review outcome is a decision about responsibility, resources and treatment across those sites. Recording that management “noted the issue” leaves the operational problem unresolved. A consolidated report should preserve consequential site differences rather than average them away.

Read the management review guide for an approach to preparing evidence and following decisions through.

Why performance evaluation matters to the business

Without evaluation, an ISMS is an act of faith. Leaders cannot tell whether controls work, whether incidents are rising or whether money is being spent in the right places. Clause 9 gives management evidence for its decisions and gives customers a reason to believe the system is maintained after the certificate or assessment is done. It is also where weaknesses are found cheaply, by the organisation itself, rather than expensively, by an attacker or an external assessor. Good evaluation turns audits and reviews from annual chores into useful business routines, helping to prioritise investment and to demonstrate that senior leaders are involved, which assessors expect.

How to implement clause 9

The three parts of clause 9 should be designed together so each informs the next. One workable order is described below. Treat measurement, audit and review as one cycle in which each part supplies the next, and avoid building three separate routines that never meet.

1. Choose a handful of measures tied to your objectives and risks, rather than a long list nobody reads.
2. Agree who collects each measure, how often and how it is judged, so results are comparable over time.
3. Build an audit programme that gives more attention to important processes and past problem areas.
4. Select auditors who are independent of the area audited, and brief them on criteria and scope.
5. Report audit and measurement results to relevant managers soon after they arise.
6. Prepare management review inputs from these sources, with clear trends and recommended decisions.
7. Record the decisions and follow them through, then use the outcomes to adjust measures and audit focus.

Evidence and common evaluation mistakes

Explore each numbered part

Illustrative example: performance evaluation

A hypothetical Japanese automotive parts supplier supports several vehicle manufacturers and holds design files that customers regard as highly sensitive. It tracks a small set of measures, including how quickly access for departing staff is removed and how many supplier connections have been reviewed. Its internal audit programme looks first at the engineering network after a spike in access exceptions. The auditor, who works in another department, traces three leavers from the human resources record to system accounts and finds one delay. The finding goes to the management review alongside the trend in exceptions. Leaders decide to automate account removal and to repeat the check in the next audit. The record of that decision becomes evidence that the evaluation cycle leads to action.