#iso27001/2013
## 9.1 Monitoring, measurement, analysis and evaluation

The organization shall evaluate the information security performance and the effectiveness of the information security management system.

The organization shall determine:

a) what needs to be monitored and measured, including information security processes and controls;

b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;

  NOTE The methods selected should produce comparable and reproducible results to be considered valid.

c) when the monitoring and measuring shall be performed;

d) who shall monitor and measure;

e) when the results from monitoring and measurement shall be analysed and evaluated; and

f) who shall analyse and evaluate these results.

The organization shall retain appropriate documented information as evidence of the monitoring and measurement results.

## 9.1 Monitoring, measurement, analysis and evaluation

  

The organization shall evaluate the information security performance and the effectiveness of the information security management system.

  

The organization shall determine:

  

a) what needs to be monitored and measured, including information security processes and controls;

  

b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;

  

NOTE The methods selected should produce comparable and reproducible results to be considered valid.

  

c) when the monitoring and measuring shall be performed;

  

d) who shall monitor and measure;

  

e) when the results from monitoring and measurement shall be analysed and evaluated; and

  

f) who shall analyse and evaluate these results.

  

The organization shall retain appropriate documented information as evidence of the monitoring and measurement results.

  

