Clause 9 requires you to evaluate ISMS performance through monitoring and measurement, internal audits, and management review, and to keep documented evidence of all three. The immediate priorities are to tie measures to your Clause 6.2 objectives, write down your measurement methods, schedule internal audits at planned intervals, and build a concise management-review pack. The underlying ISO/IEC 27001:2022 standard sets out exactly what each part must cover.
TL;DR:
- Measures should be directly linked to Clause 6.2 objectives, focusing on performance and effectiveness at process or objective levels rather than individual controls.
- Internal audit programs must be risk-based, with documented plans, clear reporting, and evidence of actual audits, including scope, findings, and corrective actions.
- Management review packs should consistently summarize previous actions, performance metrics, audit results, risk treatment progress, and resource needs, based on documented evidence.
- Choosing few, relevant metrics tied to objectives or risks improves monitoring effectiveness and reduces review burden, avoiding tracking unnecessary or noisy data.
- Preparing for audits requires verifying documented methods, closed nonconformities, and complete review records, with a focus on evidence of actual implementation rather than mere planning.
Table of Contents
- Why Clause 9 exists and how it fits the ISMS lifecycle
- Clause 9.1: how to choose what to monitor and validate your measurements
- Clause 9.2: building an audit program that survives certification
- Clause 9.3: turning management review into real decisions
- Metrics and KPIs that satisfy Clause 9 without becoming a burden
- What auditors check: common gaps and a pre-audit checklist
- How ISMS Calculator outputs map to Clause 9 evidence
- Three pragmatic priorities when implementing Clause 9
- Get Clause 9 evidence started in minutes
- FAQ
- Sources
Why Clause 9 exists and how it fits the ISMS lifecycle
Clause 9 is the feedback loop that keeps an information security management system honest. Without it, an ISMS is a pile of policies nobody checks. With it, you get a repeatable cycle: set objectives, measure progress, audit the process, review the results with leadership, and feed corrections into Clause 10 improvement actions.
The logical starting point is Clause 6.2, not Clause 9.1 itself. Your information security objectives, the measurable targets you set for things like incident response or access control hygiene, are what tell you what to monitor in the first place. Trying to build a measurement program before objectives exist is backwards, and it is why so many organizations end up tracking numbers that nobody in the business cares about.
It helps to separate two words the standard uses deliberately: performance and effectiveness. Performance is the measurable result, how many incidents occurred, how fast patches got applied, what percentage of staff completed training. Effectiveness is a judgment call: did the planned activity actually achieve what it set out to achieve? A control can perform exactly as designed and still be ineffective if the design itself does not address the real risk. Clause 9 asks you to evaluate both.
Documented information expectations run through the whole clause. You need records of the monitoring and measurement results themselves, not just a description of your methodology. Auditors are not interested in a policy that says “we measure incident response time.” They want to see the actual numbers for the period under review, along with evidence that someone looked at them and decided whether the result was acceptable.
This is also where Annex A controls come into play indirectly. Clause 9 does not ask you to measure every control individually, a point worth flagging early because it trips up a lot of first-time implementers. Instead, it asks you to monitor the objectives and processes that those controls support, which keeps the measurement burden proportionate rather than exhaustive.
Clause 9.1: how to choose what to monitor and validate your measurements
Clause 9.1 breaks into four questions the standard expects you to answer and document: what needs monitoring and measuring, what methods will produce valid results, when monitoring happens and when results are analyzed, and who does the monitoring and who analyzes the output. The ISO/IEC 27001:2022 text is explicit that these four elements need documented information as evidence of results, not just a plan.
The practical way to answer the “what” question is to work backward from your Clause 6.2 objectives and your risk assessment. If an objective states that security awareness training must reduce phishing click rates, the metric is obvious. If a risk treatment plan calls for faster patch deployment on internet-facing systems, mean time to patch is your measure. Interpretive guidance in the SC27 Journal confirms this link between Clause 6.2 objectives and Clause 9.1 measures, and recommends deriving measurements at the process or objective level rather than attempting to measure every control separately, since control-by-control measurement is often impractical and dilutes focus.
On granularity, aim for a short list of defensible numbers over a long list of vanity metrics. Quantitative examples include incident counts, time-to-detect, percentage of overdue corrective actions, and training completion rates. Qualitative examples, pass/fail checks on a configuration standard, a yes/no confirmation that a backup restore test succeeded, are equally valid when the result is impractical to express as a number. ISO/IEC 27004 supports this: where full measurement is impractical, structured monitoring combined with qualitative evidence is acceptable, provided it rests on a documented procedure and a recorded result.
Reproducibility matters more than sophistication. Write down the data source, the sampling approach if you are not capturing every event, and the calculation method, so that two different people running the same measure six months apart get comparable numbers. A measure that changes definition every quarter is worse than no measure at all, because it looks like evidence of improvement when it is really just evidence of inconsistency.
A few selection rules keep this manageable:
- Tie every measure to a Clause 6.2 objective or a specific risk treatment decision, never to a control in isolation.
- Keep the total metric count small enough that someone can review all of them in a single sitting before a management review.
- Document the method once, and reuse it every reporting period without silent changes.
- Assign a named owner to each measure, not a department, so results have someone accountable for explaining them.
Pro Tip: Before adding a new metric, ask whether a missed target would actually change a decision; if not, it is monitoring noise, not a Clause 9.1 measure.
Clause 9.2: building an audit program that survives certification
Clause 9.2 splits into two distinct obligations: maintaining an audit program (the overall plan covering frequency, methods, responsibilities, and reporting) and conducting individual audits against that program. The 2022 restructuring, described in Protiviti’s summary of the revision, separated these into clearer subclauses but kept the underlying requirement unchanged: you still need both the program-level plan and evidence that each planned audit actually happened.
Audit frequency should track risk, not the calendar. A process tied to a high-impact objective, or one that failed its last audit, deserves a shorter interval than a stable, low-risk area. ISO 19011 offers guidance on structuring an audit program this way, along with auditor competence requirements and remote-audit methods that are increasingly relevant for distributed teams.
Independence is non-negotiable but does not require a dedicated internal audit department. Smaller organizations commonly use one of three approaches:
- Rotate staff so nobody audits their own process area.
- Bring in a qualified external auditor for part or all of the cycle.
- Use a shared-services arrangement where a sister team with no stake in the process performs the review.
Each audit should produce a report covering scope, methodology, findings, and a nonconformities log with owners and due dates. According to a practical internal audit guide, certification bodies specifically look for this structure, plus evidence that corrective actions for major nonconformities were verified as closed before certification can proceed; open majors at initial certification will block the certificate.
A deeper walkthrough of program design, sampling strategy, and reporting templates is covered in our ISO 27001 internal audit playbook.
Clause 9.3: turning management review into real decisions
Management review exists to put performance evidence in front of the people who can authorize resources, not to generate a meeting minute nobody reads. The required inputs are specific: status of actions from previous reviews, changes in external and internal issues relevant to the ISMS, feedback on security performance including trends in nonconformities and audit results, feedback from interested parties, risk assessment and treatment plan status, and opportunities for continual improvement. The 2022 edition added one notable item: changes in the needs and expectations of interested parties that are relevant to the ISMS, reflecting the reorganized inputs noted in the Protiviti transition summary.
The output side is just as defined. Management review must produce decisions related to continual improvement opportunities and any need for changes to the ISMS, and both must be documented, not just discussed.
A review pack that works tends to follow the same structure every cycle:
- Open with the status of actions from the last review, closed or still pending.
- Summarize the Clause 9.1 metrics against their targets, flagging misses with a one-line cause.
- Report audit outcomes: number of audits completed, nonconformities raised, and closure status.
- Show risk treatment plan progress against the schedule, not just a risk register snapshot.
- Close with a resource request if any metric or audit finding points to a gap that needs budget or headcount.
Evidence for certification purposes is the meeting record itself: minutes that name the inputs discussed, the decisions made, and who is accountable for follow-up. A review that only says “performance discussed, no issues” gives an auditor nothing to verify and is one of the more common findings certification bodies raise.
Metrics and KPIs that satisfy Clause 9 without becoming a burden
Good metrics share four traits: they are linked to an objective or risk treatment decision, limited in number, reproducible period over period, and owned by a named person. Monitoring, a simple yes/no check or a log review, is often sufficient where a full numeric measure would take more effort than the result justifies; ISO/IEC 27004 treats both as legitimate evidence depending on what is being evaluated.
A small, defensible set of key metrics for an ISMS focuses on important security performance indicators such as incident rates, detection times, corrective action closure rates, and objective attainment checks, reported periodically by responsible owners to maintain oversight without overburdening the system.
A more detailed set of formulas, sources, and owner templates is available in our guide to audit-ready ISO 27001 metrics, useful when a dashboard needs more fields than the core four above.
Pro Tip: Build the dashboard around the management review cadence, not the other way around; a metric nobody reviews on schedule stops getting maintained within two cycles.
What auditors check: common gaps and a pre-audit checklist
Auditors look for a consistent chain: documented methods, actual results, audit reports, review minutes, and proof that corrective actions were verified, not just logged. The most frequent nonconformities are measures with no documented method, audit programs that exist on paper but skipped a planned cycle, and management reviews missing one or more of the required inputs.
A short list to run before external assessment:
- Confirm every Clause 9.1 metric has a written method and at least one full reporting cycle of results.
- Check the audit program against what was actually completed, not just scheduled.
- Verify every nonconformity from the last audit has a closure record, not just an open action.
- Confirm the last management review minutes name all required inputs and record explicit decisions.
How ISMS Calculator outputs map to Clause 9 evidence
We built our free 2-minute readiness check and maturity assessment across the four Annex A control themes to give you a starting baseline for the objectives and metrics Clause 9.1 asks for, and our model reference comparisons let you sanity-check targets against the model reference before you commit them to a management review pack.
- Our maturity assessment output translates directly into a first set of objective-linked measures per domain.
- Our customizable Gantt charts document the “when” element auditors expect for planned monitoring and audit activities.
- Our exported PDF reports and saved, comparable estimates give you documented information you can attach to an audit file or a review pack without rebuilding it from scratch.
Our readiness assessment extends this into a fuller evidence set ahead of certification.
Three pragmatic priorities when implementing Clause 9
Spend your effort on measures tied to objectives and real risk, not on tracking every control just because it exists. Treat internal audits and management reviews as decision points, places where you actually change a plan, not rituals you complete to satisfy a checklist. The biggest failure mode is not measuring too little, it is measuring too much and reviewing none of it.
— Martin
Get Clause 9 evidence started in minutes
If you are still scoping what Clause 9 implementation will cost in time and budget, our free 2-minute readiness check gives you an instant baseline without requiring a signup, and it is built on the same model reference comparisons we use across the platform. From there, our ISO 27001 Cost Calculator produces a real-time, organization-specific estimate you can save, compare, and export as a PDF report, which cuts down the prep work for both audit evidence and your next management-review pack.
- Run the free readiness check first to get a maturity snapshot across the four Annex A control themes.
- Use the cost calculator to turn that snapshot into a budgeted implementation timeline with exportable reports.
FAQ
What are the 10 clauses of ISO 27001?
ISO/IEC 27001 has 10 clauses: Scope, Normative references, Terms and definitions, Context of the organization, Leadership, Planning, Support, Operation, Performance evaluation (Clause 9), and Improvement. Clauses 4 through 10 carry the mandatory requirements that certification audits assess, with Clause 9 covering monitoring, internal audit, and management review as detailed in the ISO/IEC 27001:2022 standard.
How does Clause 9.3 management review work?
Management review takes defined inputs, including performance metrics, audit results, and risk treatment status, and produces documented decisions on improvement opportunities and any changes needed to the ISMS. The 2022 edition added interested-party changes as a required input, and the review record itself serves as the evidence auditors check.
Can you explain ISO 27001 in a simple way?
ISO 27001 is a standard that sets requirements for building and running an information security management system: you identify risks, put controls in place to treat them, and then prove through monitoring, audits, and management review that the system actually works. Clause 9 is the part that handles that proof.
What does Clause 9.1 of ISO 9001:2015 address?
ISO 9001 is a separate quality management standard, not ISO 27001, though both use a similar clause structure. Its Clause 9.1 covers monitoring, measurement, analysis, and evaluation of the quality management system, a parallel role to what Clause 9.1 of ISO/IEC 27001:2022 does for information security performance.
Do I need to measure every Annex A control under Clause 9?
No. Guidance in the SC27 Journal notes that measuring every control individually is often impractical; instead, derive measures at the objective or process level and use monitoring for areas where a full metric would not justify the effort.
Sources
- ISO/IEC 27001:2022 - Information security management systems
- SC27 Journal — interpretive guidance on monitoring, measurement, analysis and evaluation
- ISO 27001:2022 – Key Changes and Approaches to Transition (Protiviti)
- ISO 27001 internal audit guide — Security Compliance Guide