ISMS monitoring and review" phase
ISO 27001: Information Security Management Systems

Performance evaluation (clause 9)

Once this measurement method is in place, you need to measure accordingly. It's important to report these results regularly to the people in charge of evaluating them.

Surveillance (clause 9.1)

The best way to describe how measures are evaluated is through the policies and procedures that define each measure; normally, this description can be written at the end of each document, and such a description defines the type of KPI (key performance indicator) that must be measured for each measure or group of measures. Findings :

• no notion of security...