About this chapterThis chapter ensures that the organization evaluates the performance of the ISMS through monitoring, internal audits, and management reviews. It contains three sub-clauses.
9.1 Monitoring, measurement, analysis, and evaluation
The organization must determine what needs to be monitored, how, when, and by whom, and then evaluate ISMS effectiveness.
(Typical measures include incident rates, audit findings, and control performance metrics.)
9.2 Internal audit
Regular audits must be conducted to verify conformity with ISO/IEC 27001 and organizational requirements.
9.3 Management review
Top management must review ISMS performance at planned intervals, considering inputs such as audit results, incidents, risks, and opportunities, and outputs such as actions, resource needs, and improvement decisions.
(In short: leadership evaluates the ISMS and decides on improvements.)
