ISO 27001 Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation

Required activity

ISO 27001 Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation, The organization evaluates the knowledge security performance and therefore the effectiveness of the ISMS.

Implementation Guideline

The objective of monitoring and measurement is to assist the organization to gauge whether the intended outcome of data security activities including risk assessment and treatment is achieved as planned. Monitoring determines the status of a system, a process or an activity, whilst measurement may be a process to work out a worth . Thus, monitoring is often achieved through a succession of comparable measurements over a while period.

Related Products:– ISO 27001 Lead Auditor Training and Certification

For monitoring and measurement, the organization establishes:

1. What to watch and measure;
2. Who monitors and measures
3. Methods to be used so on produce valid results (i.e. comparable and reproducible).

For analysis and evaluation, the organization establishes:

1. Who analyses and evaluates the results from monitoring and measurement, and when
2. Methods to be used so on produce valid results.

There are two aspects of evaluation:

1. Evaluating the knowledge security performance, for determining whether the organization is doing needless to say, which incorporates determining how well the processes within the ISMS meet their specifications; 
2. Evaluating the effectiveness of the ISMS, for determining whether or not the organization is doing the proper things, which incorporates determining the extent to which information security objectives are achieved.

Note that as “as applicable” (ISO/IEC 27001:2013) means if methods for monitoring, measurement, analysis and evaluation are often determined, they have to be determined.

A good practice is to define the ‘information need’ when planning the monitoring, measurement, analysis and evaluation. An information need is typically expressed as a high-level information security question or statement that helps the organization evaluate information security performance and ISMS effectiveness. In other words, monitoring and measurement should be undertaken to realize an outlined information need.

Care should be taken when determining the attributes to be measured. it’s impracticable, costly and counterproductive to live too many, or the incorrect attributes. Besides the prices of measuring, analyzing and evaluating numerous attributes, there’s an opportunity that key issues might be obscured or missed altogether.

There are two generic sorts of measurements:

1. Performance measurements, which express the planned leads to terms of the characteristics of the planned activity, like head counts, milestone accomplishment, or the degree to which information security controls are implemented; 
2. Effectiveness measurements, which express the effect that realization of the planned activities has on the organization’s information security objectives.

Also Read:– ISO 27001 Clause 9.2 Internal audit

It is often appropriate to spot and assign distinctive roles to those participating within the monitoring, measurement, analysis and evaluation. Those roles are often measurement client, measurement planner, measurement reviewer, information owner, information collector, information analyst and knowledge communicator of input or output of evaluation.

The responsibilities for monitoring and measurement and people for analysis and evaluation are often assigned to separate persons whom different competence is required.

Monitoring, measurement, analysis and evaluation is critical to the success of an efficient ISMS. There are variety of clauses in ISO/IEC 27001 that explicitly require determination of the effectiveness of some activities. for instance, ISO/IEC 27001:2013). Further information are often found in ISO/IEC 27004, which provides guidance on meeting the wants of ISO/IEC 27001:2013, especially, it expands on all of the concepts mentioned above, like roles and responsibilities, and forms, and provides numerous examples.

---

This Blog Article is posted by

Infosavvy, 5B 306 Riverside Greens, Panvel, Raigad 410206 Maharashtra, India
Contact us – www.infocerts.com
https://goo.gl/maps/mHkyURHmeFXyGiVw5