# Clause 9: Performance evaluation

Clause 9 handles Performance evaluation. It consists of 3 parts:
- [Monitoring, measurement, analysis and evaluation](../../../MoCs/ISO_27001_2022_9.1_MoC%20Monitoring,%20measurement,%20analysis%20and%20evaluation.md)
- [Internal audit](../../../MoCs/ISO_27001_2022_9.2_MoC%20Internal%20audit.md)
- [Management review](../../../MoCs/ISO_27001_2022_9.3_MoC%20Management%20review.md) 

Looking at clause 9.1, Monitoring, measurement, analysis and evaluation, the organization needs to decide what parts of the ISMS they would like to monitor on a regular basis, so that the performance can be evaluated.

Monitoring and measuring involves:
- setting objectives for measuring and monitoring:
- selecting what to measure (which attributes)
- establishing performance indicators and targets (how to recognize succes)
- evaluating if the objectives are achieved.
  
It's important to note that an organization is *not* expected to monitor, measure, analyse and evaluate each and every item of clause 4 to 10 and the Annex. 

As the standard itself doesn't prescribe *what* to monitor, your best choice is taking the security objectives as a starting point. So what and how will the organization measure and check whether those objectives (from [6.2](../../../MoCs/ISO_27001_2022_6.2_MoC%20Information%20security%20objectives%20and%20planning%20to%20achieve%20them.md)) are being fulfilled.

Other focus points may be controls that are implemented to deal with significant risks (from [6.1.2](../../../MoCs/ISO_27001_2022_6.1.2_MoC%20Information%20security%20risk%20assessment.md)), and legal and regulatory compliance.

Besides identifying what to monitor, the organization must determine how frequently those measurements will take place, who will be taking them, and which actions will be taken in response.

The standard also doesn't tell us what targets we should have for indication success. So the organization needs to set them for themselves, or deduce them from contractual obligations, legal obligations, or from obligations under the standards (from [Clause 4.2](../../../MoCs/ISO_27001_2022_4.2_MoC%20Understanding%20the%20needs%20and%20expectations%20of%20interested%20parties.md)).

An organization can also have their own KPIs (key performance indicators). When designing and implementing the ISMS, it's advisable to identify early on what those key performance indicators are.

As an auditor you want to see that the organization is checking those things regularly.

## Internal audits

The purpose of internal audits ([Clause 9.2](../../../MoCs/ISO_27001_2022_9.2_MoC%20Internal%20audit.md)) is to validate whether the ISMS confirms to the ISO 27001 standard, and whether it's working effectively: is it effectively implemented, maintained, does it help the organization to fulfill its objectives, etc.

Clause 9.2.2b demands the **independence** of the audit process, which in practice means the auditors must be independent of the work they're assessing, and be able to make honest observations based on the evidence they see. The organization must also validate that internal auditors have the necessary **competence** to perform an audit ([Clause 7.2](../../../MoCs/ISO_27001_2022_7.2_MoC%20Competence.md)).

The auditor must also check if there's an **audit program** in place, and that the internal audit is not just a one-off effort. So that means a series of planned audits over a period of time. There might be a yearly overall audit, or audits focussing on certain area's over time, or audits that focus more deeply into particularly critical areas (high risk or core business processes)

### Management Review
The management review ([Clause 9.3](../../../MoCs/ISO_27001_2022_9.3_MoC%20Management%20review.md)) is meant to give top management the opportunity to see what is happening with the management system. This doesn't have to be a meeting called "management review", but it needs to happen at regular intervals. The person overseeing the ISMS is usually the person that calls and facilitates the review.

The agenda for the meeting is given in Clause 9.3.2. It's important that the meeting is focussed on the **strategic aspects** of the ISMS: does it align with the objectives and requirements of the organization, does the scope need to be changed, etc. – in other words, judging the ISMS's suitability, adequacy and effectiveness), and that **decisions** can be made on those aspects.

