The organization shall determine what to monitor/measure, methods, frequency, and when to analyze/evaluate results, and retain documented information.
In operational terms: Run the ISMS with evidence—measure what matters, analyze trends, and use results to steer decisions and improvements.
Auditors will typically look for evidence that the organization:
a. Selects meaningful indicators (incidents, patch SLAs, findings, training, backups, etc.).
b. Defines methods and timing so results are reliable and comparable.
c. Uses results for decisions (risk updates, objective progress, improvement actions) and keeps records.
