Written By: Alan Parker
Last Updated: 29/4/26

---

---

---

View my video below for a 3 minute summary of Clause 9 – Performance

Clause 9.1 – Monitoring, Measurement, Analysis and Evaluation

ISO 27001 Clause 9.1 requires you to evaluate the ISMS performance by determining:

• What needs to be monitored and measured,
• The methods for monitoring, measurement, analysis, and evaluation (basically, how you’ll do it to ensure valid results),
• When should monitoring and measuring be done (frequency),
• Who shall analyse and evaluate the results?

In practice, you should have a set of ISMS metrics or performance indicators, along with a process for reviewing them.

When I’m consulting with people, I suggest that as they move through 27001, they should consider how to measure what they are implementing, and certainly whether, as stated in a policy or procedure, they are. So, I advise people to take notes on potential KPIs and obligations as they go.

We touched on this in the overview: Clause 9.1 often involves defining a few key performance indicators (KPIs) or security metrics.

Common examples:

• Number of information security incidents (perhaps categorised by severity) per quarter.
• Average time to resolve incidents.
• Percentage of staff who have completed training.
• Number of audit findings (internal or external).
• System uptime for critical systems (if availability is a key concern).
• Compliance rates with key security processes (e.g., the percentage of new hires who received accounts within the SLA or the percentage of systems with the latest patches).
• Results of phishing test (e.g., % of employees who clicked a test phishing email).
• It could even be financial, like security spending as a percentage of IT spending (though not as useful for effectiveness).

ISO 27001 doesn’t dictate which metrics—you choose the ones that make sense for your risks and objectives. But whatever you choose, I recommend that you ensure you are actually measuring and evaluating it. For example, if you set an objective to reduce incidents, you must track incidents. An auditor will specifically look at things like that.

Analysis and evaluation mean you don’t just collect data; you interpret it. As an example, if you had 5 incidents this year vs 2 last year, what does that mean? Possibly, more incidents could mean improved detection (if previously you weren’t catching them) or worse security. This analysis would inform decisions during the management review.

Documentation

Many organisations maintain a metrics dashboard or report that they update periodically (monthly, quarterly). Some integrate into management review presentations.

Also, Clause 9.1 encompasses evaluating ISMS effectiveness overall, not only metrics. It could include tasks such as compliance checks (ensuring procedures are followed) outside formal audits, and reviewing the achievement of objectives. But much is already covered by audits and reviews.

The output of Clause 9.1 is typically documented as the result of the analysis. At minimum:

• Have defined metrics (maybe in a procedure or the objectives document).
• Keep records of measurements (logs, reports).
• Summaries or analysis reports (could be part of management review minutes or a standalone “ISMS performance report”).

The auditor will check that you have identified some measurements and that you provide evidence that you carry them out. They might see a report or ask, “How do you measure the effectiveness of your ISMS?”

---

Grab my ISO 27001 Toolkit, which includes all the Clause 9 document templates you need.

---

Clause 9.2 – Internal Audit

Clause 9.2 requires you to conduct internal audits of the ISMS at planned intervals.

It has two sub-clauses in 2022:

9.2.1 General

You must conduct internal audits to ensure the ISMS meets ISO 27001 and your own requirements and is effectively implemented and maintained.

9.2.2 Internal Audit Programme

This gets into the specifics: You need to plan the audits, considering the importance of processes and past audit results, define the audit criteria and scope for each audit, select competent auditors (who are impartial to the area being audited), and ensure audit results are reported to management.

What this means practically:

• You should create an internal audit plan/schedule. Often it’s annual: e.g., “We will audit the entire ISMS (clauses 4-10 and Annex A controls) once a year.” Some bigger orgs do partial audits quarterly, etc. For SMEs, a yearly audit covering everything is typical.
• You might audit different areas separately. For instance, audit Clause 4-8 in one session, Clause 9-10 in another, and Annex A controls by domain. Or do it all in one marathon. Just plan it out.
• Make sure the auditor is not auditing their own work. If you only have 3 people, you might outsource the internal audit or swap with another trained person in another department. Auditors must be objective.
• Create an audit checklist or criteria referencing the ISO clauses and your policies. This helps ensure you check each requirement.
• Conduct the audit: interview folks, review documents, etc., similar to how a certification auditor would, but internal. Identify any nonconformities or observations.
• Report the results. Typically, an internal audit report lists what was audited, who conducted the audit, findings (nonconformities, observations), and perhaps positives or a general assessment. Nonconformities from the internal audit feed into Clause 10 (corrective actions).
• Ensure the report goes to relevant management so they know and can act.

The required documentation includes the internal audit program (schedule) and internal audit reports (and records of any findings). ISO 27001 specifically expects you to keep records of audit results​.

As part of the certification audit, you must have at least one full internal audit cycle completed. If you haven’t audited your ISMS internally, the certification auditor cannot certify you because that’s a requirement.

The auditor (the external one) will review your internal audit process: they might ask for the schedule and the internal auditor’s competency (training cert, perhaps), and they will read the internal audit report(s). They will check that you have addressed any nonconformities found (or plan to).

Also, be honest in internal audits – it’s fine to have findings; if an internal audit report shows zero findings, an external auditor might be sceptical (“Really, a first-time ISMS had no issues?”). It’s normal to have some minor issues and then show how you fixed them.

How to Maintain Objectivity & Impartiality in a Smaller Business

One of the problems my clients, who are often small tech startups, face is: “How do we maintain the standards of objectivity and impartiality that are expected by the standard’s text when we only have a couple of people in the business?”

Good question, glad you asked, it isn’t easy.

So ideally, the person auditing the ISMS isn’t involved in creating it. Or at very least, wasn’t involved in creating or running those aspects (so, you could swap with someone else to audit their area of responsibility), but let’s assume you just don’t have the resource. First thing is, different auditors will look at this differently. Some will be very by the book, and others will understand the problems of impartiality in a small or micro organisation where you just don’t have the options.

There are a few options I’d suggest.

1) Hiring an Internal Auditor via 3rd Party – So, getting someone like me to come in and audit you, so that you are confident the ISMS is working well before you go into your audit. Not all companies have the luxury of the budget for this, so you may have to look at option 2.

My internal audit service explained

2) Self-Auditing, with review – If it’s totally unavoidable due to financial and resource limitations, then you can explain your method in the internal audit approach (you should have something that outlines the who, when and how you approach the audit) and perhaps review the outputs with one other person in the business who may not fully understand 27001, but can review and challenge the audit approach and results, then sign them off.

Internal Audit Schedules

I usually say to clients, “If the question in ISO 27001 is: How often? The answer is: At least annually”, which is true, except when it comes to internal auditing. The standard just says it needs to be at planned intervals, which is a little open to interpretation.

What I’d suggest as a minimum: audit at a similar frequency to your external certification audits, but in front of them. So, if you are audited in depth for certification once every three years, then auditing in depth once every three years (and hey, not two weeks in advance of your external audit, please) is enough. However, I’d also say that, since you have surveillance audits every year, a similar selection of problem areas, or random controls once a year for audits, would be a good idea.

I’ve written more about conducting Internal Audits here.

---

Clause 9.3 – Management Review

Top management must review the ISMS periodically (usually annually) per Clause 9.3. In ISO 27001:2022, it’s broken into:

9.3.1 General

States that management must review the ISMS at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with strategic direction.

9.3.2 Management Review Inputs

Specifies what must be considered in the review. The standard explicitly lists inputs:

• Status of previous actions from the last reviews.
• Changes in external and internal issues (remember Clause 4 context – have there been changes in context or scope?).
• Feedback on information security performance (results from monitoring and measuring (9.1), audit results (9.2), compliance status with requirements, etc.).
• Incidents and nonconformities, and corrective actions (10.1/10.2 stuff).
• Results of risk assessment and status of risk treatment plan (so what’s new or changed in risks since last time).
• Opportunities for continual improvement.

9.3.3 Management Review Results

Specifies the review’s outputs: decisions and actions to improve the ISMS, required changes, and resource needs.

In practical terms, a Management Review is typically a meeting (or series of meetings) held once a year (some do twice a year).

Participants usually include top management (CEO, COO, etc.), the ISMS manager, and, if applicable, key department heads or members of the security committee. They discuss all the above inputs.

To run a management review:

• Prepare a Management Review Agenda covering all required inputs.
• Gather relevant data ahead of time, e.g., incident summaries, audit findings, training stats, new risks, changes in the business, etc.
• In the meeting, go through each item. Discuss and record discussion points and any decisions.
• Typical decisions: “We need to allocate more budget for new firewall next year,” “We will revise the risk acceptance criteria because of [reason],” “No changes to scope needed at this time,” “Set a new objective to improve incident response speed,” “Management is satisfied with performance, only minor improvements X and Y noted,” etc.
• After the meeting, produce minutes or a report documenting the review. Note the decisions and actions, and assign owners/deadlines as needed for actions.
• Follow up on those actions (they become part of continual improvement).

Read more here in my guide on How to run a management review

The required documentation is evidence of the management review and its outputs. Typically, this is meeting minutes or a management review report. It should be dated and list attendees (to show top management was involved). This is a mandatory record​.

Auditors love to see a thorough management review because it demonstrates top management involvement (Clause 5) and overall control of the ISMS. They will check that the minutes cover all required inputs (they might literally cross-check the list against the minutes’ content). If something wasn’t discussed, they might mark a minor Noncompliance (or “Opportunity for Improvement”).

Also, the auditor will want to see that any action items from the previous management review were addressed in the next one (which’s why “status of previous actions” is an input).

For a first certification, you should have at least one management review done (covering the period since the start of ISMS implementation).

If you finish implementing and immediately call auditors, do a management review meeting before they arrive.

---

Documentation and Outputs for ISO 27001 Clause 9

---

What Auditors Look For in ISO 27001 Clause 9

Defined Metrics and Data

The auditor will ask, “How do you measure your ISMS performance?” Expect to show them your list of metrics or KPIs. If you have none, that’s a nonconformity. They will then look at data – e.g., if you say incidents are tracked, they might say, “How many incidents occurred last year?” You should have that number readily. If you achieved improvements, mention them. The auditor is checking that you are actively monitoring and that you know whether you’re improving.

Internal Audit Process

The auditor will do an audit of your internal audit. They’ll check:

• The independence of the internal auditor (e.g., if your IT manager audited IT processes, that’s not independent; it’s better if someone else or an external auditor did).
• The competence – “Who did the audit and have they been trained?” Show evidence as discussed.
• The scope and frequency—“When do you conduct internal audits? Let me see the plan.” They’ll ensure you’re covered the full standard (maybe in one go or over time). If some parts weren’t audited, that’s a gap.
• Findings and actions – They will read the internal audit report. If it lists nonconformities, they’ll ask “What did you do about these?” (which should tie into Clause 10 corrective actions – they might follow a particular finding to see if you resolved it). If your internal audit found nothing, they might carefully look themselves for something to see if you missed it, as a test of audit effectiveness.
• They might also check that results were reported to management (evidence could be found in management review minutes that reference the internal audit).
• Records retention: Ensure those reports are retained. (ISO expects them to be kept, obviously at least until the next cycle.)

Management Review thoroughness

Auditors will typically request the management review minutes and any accompanying reports. They will verify that:

All required inputs (as per 9.3.2) are covered. They might, for example, highlight: “I don’t see anything about changes in external/internal issues in these minutes – did you discuss that?” If not, they’ll issue a minor NC requiring you to include that next time.

• Top management presence: If no executives attended, they may question compliance with Clause 5/9.3. Ideally, an executive or two is on the attendee list.
• Decisions made: If the minutes show no decisions or actions, just a perfunctory meeting, they may suggest that it should be more insightful. But if everything were perfect, no significant action may be needed; still, typically something comes up (even “continue current course” is a decision).
• Follow-up from last review: If this is not your first ever, they’ll check that last year’s actions were reviewed. For initial certification, it is not applicable, but in the surveillance year, they will definitely check.

They might ask the management present: “What’s your impression of the ISMS effectiveness? Are there any areas you see needing improvement?” The answer should align with what’s in the review records.

Resource decisions

If any resource needs were identified but not addressed, they might flag that leadership didn’t provide resources (tying back to Clause 5 and 7.1). So management review should identify and resolve resource issues, or at least have a plan.

Continual Improvement evidence

Clause 9 is about checking, but through internal audit findings and management review, they’ll naturally see if you are improving.

For example, if the internal audit last year had 5 findings and this year only 1, that’s an improvement. Or the management review might note that the “risk level overall reduced.” They won’t explicitly mark Clause 9 for improvement (that’s Clause 10), but they will see if Clause 9 processes drive Clause 10.

---

---

ISO 27001 Clause 9 FAQs

Further Reading

ISO 27001:2022 standard

---