ISO 27001 Monitoring and Measurement: Complete 2026 Guide

ISO 27001 monitoring and measurement is the part of clause 9 that most organizations treat as a dashboard exercise and then lose a finding on, because clause 9.1 does not ask for a dashboard. It asks for six recorded decisions about what you measure, by what method, when, and who does it. An auditor who opens your ISMS and finds twelve beautiful charts with nothing behind them explaining how those numbers were produced will still raise a nonconformity.

This guide covers what ISO/IEC 27001:2022 clause 9.1 actually says about ISO 27001 monitoring and measurement, the difference between performance and effectiveness that catches people in stage 2, fourteen worked measures you can lift and adapt, and the five mistakes that reliably turn this clause into an audit finding.

What ISO 27001 Monitoring and Measurement Actually Requires

Clause 9.1 is short — one paragraph of requirements and one closing sentence — but its scope is wide. It covers “information security processes and controls,” which means two things are in play at once: the management system processes you built to run the ISMS, and the Annex A controls you declared applicable in your Statement of Applicability.

That second half is where scoping goes wrong. ISO/IEC 27001:2022 has 93 Annex A controls across four themes — 37 organizational, 8 people, 14 physical and 34 technological. You do not have to produce a metric for every applicable control, and no sensible auditor expects one. What you do have to show is that you made a deliberate decision about which controls and processes need monitoring, rather than measuring whatever your tooling happened to export.

Clause 9.1 is mandatory. There is no exclusion mechanism in clauses 4 to 10 — the Statement of Applicability lets you justify excluding Annex A controls, not management system requirements. Every certified ISMS needs ISO 27001 monitoring and measurement in place, including a very small one.

Clause 9.1: The Six Decisions You Have to Record

ISO 27001 monitoring and measurement comes down to six determinations the standard requires you to make. Treat them as columns in a register rather than paragraphs in a policy, and clause 9.1 stops being abstract:

• a) What needs to be monitored and measured, including information security processes and controls. This is the selection decision, and it needs a rationale — normally traceability back to your objectives, your risk treatment plan, or a control that your risk assessment flagged as load-bearing.
• b) The methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results. The standard notes that the methods selected should produce comparable and reproducible results to be considered valid. In practice that means naming the data source and the formula, not just the metric.
• c) When the monitoring and measuring shall be performed. A frequency per measure — not one blanket “quarterly” for everything.
• d) Who shall monitor and measure. A named role that collects the raw data.
• e) When the results shall be analysed and evaluated. This is deliberately separate from (c). Collection and interpretation are different activities on different clocks.
• f) Who shall analyse and evaluate these results. Usually not the same person as (d), and auditors notice when it always is.

The closing sentences add the two requirements people skip: documented information shall be available as evidence of the results, and the organization shall evaluate the information security performance and the effectiveness of the information security management system.

Performance and Effectiveness Are Two Different Questions

That last sentence asks for two evaluations, and conflating them is the most common substantive gap in this clause. Credible ISO 27001 monitoring and measurement answers both questions, not just the easier one.

Performance asks whether a control or process is operating as designed. Did we patch 94% of critical vulnerabilities inside the 14-day window we committed to? That is a performance measure. It tells you about compliance with your own rule.

Effectiveness asks whether operating that control is achieving the security outcome you wanted. If you hit your patch SLA every month and the number of incidents traced to unpatched systems does not move, the control is performing and not working — either the window is too long, the asset inventory feeding it is incomplete, or the risk was never really about patching.

A practical test before your stage 2: for each measure in your register, write down which of the two questions it answers. If every row says “performance,” you have not met the second half of clause 9.1, and that is a legitimate finding even though your numbers are all green.

Fourteen Worked ISO 27001 Monitoring and Measurement Examples

A workable ISO 27001 monitoring and measurement register usually mixes both types. These are starting points, not a prescribed set. Pick the ones that map to risks and objectives you actually have, and delete the rest — a short register that gets produced every month beats a long one that gets produced once before the audit.

Measure	What it tells you	Type	Suggested frequency
Critical and high vulnerabilities remediated within your defined window	Whether technical remediation keeps pace with discovery	Performance	Monthly
Incidents traced to a known, unremediated vulnerability	Whether the remediation window is actually short enough	Effectiveness	Quarterly
Mean time to detect and mean time to contain security incidents	Whether detection and response are improving	Effectiveness	Quarterly
Percentage of in-scope assets present in the asset inventory	Whether every other technical measure has a complete denominator	Performance	Monthly
Access reviews completed on schedule for privileged accounts	Whether the review control is being operated	Performance	Quarterly
Orphaned or stale accounts found during access review	Whether joiner-mover-leaver is working upstream	Effectiveness	Quarterly
Leaver access revoked within the committed interval	Offboarding discipline against a hard deadline	Performance	Monthly
Phishing simulation reporting rate, not just click rate	Whether awareness training changed behaviour	Effectiveness	Quarterly
Awareness training completion across in-scope staff	Coverage of a mandatory control	Performance	Quarterly
Corrective actions closed by their agreed due date	Whether clause 10.2 is a real loop or a parking lot	Performance	Monthly
Risks accepted above tolerance and still open past review date	Whether risk acceptance is being revisited	Effectiveness	Quarterly
Supplier security reviews completed for critical suppliers	Operation of your third-party control	Performance	Semi-annual
Backup restore tests passed, not backups completed	Whether recovery actually works	Effectiveness	Quarterly
Change records raised after the fact rather than before	Whether change control is being bypassed under pressure	Effectiveness	Monthly

If you want a deeper method for selecting and prioritising measures, NIST’s SP 800-55 Volume 2, Developing an Information Security Measurement Program, is free and finalised in December 2024. It is written for federal systems but the selection logic is framework-agnostic, and we have summarised its indicator model in our guide to NIST SP 800-55. ISO’s own guidance standard for this clause is ISO/IEC 27004:2016, which is still the current edition; a third edition reached Draft International Standard stage in 2026 and has not published yet.

What the 2022 Edition Changed in Clause 9.1

If your ISMS documentation was written against the 2013 text, two wording changes affect how you evidence ISO 27001 monitoring and measurement.

First, the evidence requirement moved from “retain appropriate documented information as evidence of the monitoring and measurement results” to the plainer “documented information shall be available as evidence of the results.” The substance is the same — you still need records — but “available” is broader than “retain,” and auditors read it as covering the analysis output, not just the raw numbers.

Second, the 2022 text carries the note that methods should produce comparable and reproducible results to be considered valid. That is the sentence behind the most common method finding: a measure whose definition quietly changed between quarters, so the trend line is meaningless. If you redefine a measure, say so in the register and restate the baseline.

Worth knowing what did not change: Amendment 1:2024, the free climate change amendment, added text to clauses 4.1 and 4.2 only. It does not add a clause 9.1 requirement. If climate-related issues turn out to be relevant to your ISMS, a measure may follow from your own objectives, but the amendment itself does not mandate one.

Where ISO 27001 Monitoring and Measurement Feeds the Rest of the ISMS

Clause 9.1 is not a standalone exercise, and the fastest way to make it defensible is to wire it to the clauses on either side of it.

Clause 6.2 is upstream. Every information security objective has to be monitored, so each objective should appear in the measurement register. If an objective has no measure, one of the two is wrong — see our guide to ISO 27001 information security objectives for the seven tests each one has to pass.

Clause 9.2 is parallel. Internal audit checks conformity; measurement checks performance. They answer different questions and neither substitutes for the other, which is why an ISO 27001 internal audit programme does not discharge clause 9.1.

Clause 9.3 is downstream. Monitoring and measurement results are an explicit required input to ISO 27001 management review. This is the hinge that makes the clause worth doing: measures that never reach a decision-making table are just reporting.

Clause 10 closes the loop. A measure that sits outside tolerance should generate either a corrective action or a documented, reasoned decision not to act. Silence is the finding.

Five Mistakes That Turn Clause 9.1 Into a Nonconformity

These are the ISO 27001 monitoring and measurement failures certification bodies write up most often, in rough order of how often I see them.

• Measuring what the tooling exports. A SIEM dashboard is a data source, not a measurement programme. Without the six decisions recorded against each number, there is no evidence you determined anything.
• No analysis step. Charts with no written interpretation fail requirement (e) and (f). One short commentary per reporting cycle — what moved, why, what we are doing — is usually enough.
• Everything green, forever. A register where nothing has ever breached a threshold normally means the thresholds were set below current performance. Auditors probe this, and it undermines the validity of the whole set.
• One frequency for everything. Clause 9.1(c) and (e) are per-measure decisions. A single “reviewed annually” line covering fourteen measures reads as a template that was never tailored.
• Collector and evaluator are the same person every time. Not prohibited, but combined with (b) and no documented method it looks like unverified self-reporting.

Frequently Asked Questions

How many measures does ISO 27001 require? The standard does not specify a number. My own recommendation is roughly eight to fifteen for a first certification: enough to cover your objectives and your highest-risk controls, few enough that one person can produce the pack every month without it slipping.

Is a documented measurement procedure mandatory? Clause 9.1 requires documented information as evidence of the results, not a procedure. But the six determinations have to live somewhere auditable, and a one-page procedure plus a register is the cheapest way to show them. Most certification bodies will ask to see it.

How often does ISO 27001 monitoring and measurement have to happen? As often as you decided under (c), which is the point — you set the frequency and then you have to hold to it. Monthly for operational measures and quarterly for outcome measures is a common pattern, with everything consolidated for management review at least annually.

Do we need to buy ISO/IEC 27004? No. It is guidance, not a requirement, and nothing in clause 9.1 references it normatively. It is useful if you want worked measurement constructs, but you can satisfy the clause without it.

Can an external penetration test count as a measure? It can feed one, but a test result on its own is an event, not a measure. Turn it into something comparable over time — findings by severity, or time to remediate test findings — and it works.

Where to Start

Get ISO 27001 monitoring and measurement right by building the register before you build the dashboard. Four columns of the six decisions, one row per measure, each row traceable to an objective or a risk — then let the reporting follow from that. ISO 27001 monitoring and measurement goes wrong almost every time because the reporting was built first and the reasoning was reverse-engineered afterwards.

For the wider picture of how clause 9.1 sits inside the certification process, start with our guide to ISO 27001 certification.

If you would rather not draft it from scratch, the measurement procedure, metrics register and management review pack that clause 9.1 feeds are already written in the ISO 27001 Toolkit — 165 templates covering the full management system for $99, ready to tailor to your scope.