iFour Consultancy

ISO 27001 - Management Clause 9

ISO 27001 - Management Clause 9
 Performance evaluation
o In order to make systematic improvements in Information security controls, processes and management
system

Monitor

Evaluate
/Audit/ Measure
Review

Analyse

ISO for Software application development India

Performance evaluation
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.3 Management review

ISO for Software application development India

9.1 Monitoring, measurement, analysis and evaluation

 Actions involved:
o Decide what needs to be monitored and measured
o Monitor customer’s satisfaction
o Analyse and evaluate data and information

ISO for Software application development India

9.1 Monitoring, measurement, analysis and evaluation
(Contd)
Determine most
Performance Determine what
appropriate
Requirement can be measured
measurement(s)
Action
Required
Create measuring
procedure
Y
N
Measure
N
Escalation
Required
Report
measurements
Raise
improvement
Y
Analyse figures

https://issuu.com/public-it/docs/isms09005_process_for_monitoring__m?e=7139440/30590160

Escalate to top
Evaluate management
ISO for Software application development India
9.1 Monitoring, measurement, analysis and evaluation
(Contd)
 Documentation Requirements
o Documents, logs, periodic reports on IS risks, Incidents and changes

 Implementation Requirements
o Identifying various IS Metrics to be monitored and measured
o Assigning monitoring responsibilities to the competent staff

 Audit Requirements
o Review reports on various ISMS metrics, and measurements

ISO for Software application development India

9.3 Management review
 Top management reviews the organisation’s management system at regular intervals
 Documentation Requirements
o M R meeting minutes / decisions related to ISMS

 Implementation Requirements
o Ensuring Management reviews ISMS performance periodically
o Management conducting periodic reviews on ISMS performance, status of previous issues, risk assessments
reports, Audits, NCs, Corrective actions, and feedback

 Audit Requirements
o Review ISMS performance reviews
o Review results of MRs (Corrective actions)

ISO for Software application development India

Requirements for documented information
 Evidence of the monitoring and measurement results (9.1)
 Evidence of the audit programme(s) and the audit results (9.2)
 Evidence of the results of management reviews of the ISMS (9.3)

ISO for Software application development India

References

 http://www.iso27001security.com/html/27001.html
 https://en.wikipedia.org/wiki/ISO/IEC_27001:2013
 http://www.imsm.com/gb/iso-9001-revision/iso-90012015-clause-9/
 https://issuu.com/public-
it/docs/isms09005_process_for_monitoring__m?e=7139440/30590160

ISO for Software application development India

For more details

Visit- http://www.ifour-consultancy.com
Or
http://www.ifourtechnolab.com

ISO for Software application development India

ISO for Software application development India