Clause 9 of ISO 27001 is where you prove the ISMS works. It asks you to measure your security performance (9.1), audit your own system (9.2) and have top management review the results (9.3), then keep records of all three. This guide covers what each sub-clause requires, the evidence auditors expect, and how to size the work for a startup or a finance firm.
TL;DR
- Clause 9 has three parts: monitoring and measurement (9.1), internal audit (9.2) and management review (9.3).
- You choose your own metrics, but you must define what is measured, how, when, by whom, and who evaluates the results.
- Internal audits need a program, impartial auditors and reports that reach relevant management.
- Management review is a top-management activity with required inputs and outputs, and minutes serve as evidence.
- Effort depends on company size, maturity and existing tooling, so estimate it before you commit a budget.
Table of Contents
- What Clause 9 covers
- Clause 9.1: monitoring, measurement, analysis and evaluation
- What records to keep
- Clause 9.2: internal audit
- Clause 9.3: management review
- Tailoring Clause 9 to startups and finance firms
- Estimating the effort to implement Clause 9
- Our perspective: treat Clause 9 as a feedback loop, not paperwork
- Put numbers on your ISO 27001 plan
- FAQ
- Sources
What Clause 9 covers
ISO/IEC 27001:2022 titles Clause 9 “Performance evaluation”. It requires organizations to evaluate information security performance and the effectiveness of the ISMS. It is divided into three requirements:
| Sub-clause | Title | What it asks for |
|---|---|---|
| 9.1 | Monitoring, measurement, analysis and evaluation | Decide what to measure, how, when and who evaluates it |
| 9.2 | Internal audit | Planned audits of the ISMS against your own requirements and the standard |
| 9.3 | Management review | Top management reviews the ISMS at planned intervals |
Think of it as the “check” step in a Plan-Do-Check-Act cycle. NQA, a certification body, describes Clauses 4 to 10 in exactly those terms, with Clause 9 as the evaluation stage. Clauses 4 to 8 build and run the system. Clause 9 tells you whether it is doing what you said it would, and Clause 10 acts on what you find.
This is why auditors lean on it. A policy set can look fine on paper. Clause 9 evidence shows whether anyone actually looked at how it performs.
For a deeper working view with KPIs and a review pack, see our guide on ISO 27001 Clause 9 for ISMS teams.
Clause 9.1: monitoring, measurement, analysis and evaluation
The standard is short here, and that is the trap. It does not hand you a list of metrics. It requires you to determine:
- What needs to be monitored and measured, including information security processes and controls.
- The methods for monitoring, measurement, analysis and evaluation, so that results are valid.
- When monitoring and measuring is performed.
- Who monitors and measures.
- When results are analyzed and evaluated.
- Who analyzes and evaluates them.
The word “valid” matters. ISACA’s implementation guide notes that reliable evaluation needs methods that produce comparable and reproducible results, so that a trend such as incident counts can be read correctly over time. If one analyst counts phishing reports weekly and another counts only confirmed incidents monthly, you have numbers but not a trend.
Choosing metrics that fit your risks
The same guide points out that organizations should align performance indicators with their own security risks and objectives rather than copy a fixed list. Start from your information security objectives and risk treatment plan, then ask what number would tell you each one is on track.
A workable metric has five properties:
- A clear definition. What exactly is counted, and over what period.
- A formula and data source. Where the number comes from, so someone else can reproduce it.
- An owner. One named role, not a team.
- A target or threshold. Without one, you cannot evaluate, only report.
- A review point. The meeting or date where the number gets looked at.
Examples that tend to survive an audit: percentage of endpoints with current patches against your own patch deadline, time to revoke access after an employee leaves, share of staff who completed security awareness training by the due date, number of security incidents by severity and time to close, and percentage of critical suppliers with a completed review. We lay out eight with formula, source and owner in our piece on audit-ready ISO 27001 metrics, and the objectives they support in information security objectives examples.
Keep the set small
Teams often start with 30 metrics and abandon half within a quarter. Auditors prefer eight measures that are collected on schedule and discussed over thirty that are not. A metric you never act on is a candidate for removal, and removing it with a recorded reason is itself good evidence.
What records to keep
Clause 9.1 states that you must retain appropriate documented information as evidence of the monitoring and measurement results. Across the whole clause, ISACA’s guide lists the records auditors expect to see: monitoring and measurement results, the internal audit program and audit results, and management review minutes. They show the ISMS is being monitored, evaluated and improved as planned.
In practice, build one evidence folder per cycle:
- The metric register (definitions, owners, targets).
- Dated metric snapshots or dashboard exports.
- The audit program, audit plans, checklists and reports.
- Nonconformity records and corrective action tracking.
- Management review agenda, supporting pack and signed minutes.
Date everything and keep version history. A screenshot with no date is weak evidence. For a catalog of what counts, read types of evidence for ISO 27001 audits, and for how certification auditors sample records, see ISO 27001 audit stages. Document control habits that keep all of this findable are covered in Clause 7.5 register and evidence pack.
Clause 9.2: internal audit
Clause 9.2 requires you to conduct internal audits at planned intervals to confirm the ISMS conforms to your own requirements and to the standard, and that it is effectively implemented and maintained.
The same clause expects an audit program that defines frequency, methods, responsibilities, planning requirements and reporting. For each audit you define criteria and scope, choose auditors so the process is objective and impartial, and report results to relevant management. You also keep documented information as evidence of the program and the results.
Planning the audit program
The standard does not say “annually”, and you should not read that into it. Most organizations cover the full scope across a year because certification and surveillance audits follow a yearly rhythm, but your program can be risk-based: audit higher-risk or recently changed areas more often. NIST’s older but still cited SP 800-14 offers the underlying principle, suggesting that periodic reviews and audit trail analysis are essential for operational assurance.
A simple program for a mid-sized company might look like this:
| Quarter | Focus | Typical evidence sampled |
|---|---|---|
| Q1 | Access control, joiners and leavers | Access reviews, offboarding tickets |
| Q2 | Supplier management, change management | Supplier reviews, change approvals |
| Q3 | Incident response, backup and recovery | Incident log, restore test records |
| Q4 | Risk assessment, management review prep | Risk register, treatment plan status |
This is an illustration of how to spread coverage, not a required schedule.
Impartiality in small teams
Impartiality is the sticking point for startups. The auditor cannot audit their own work. If your security lead built the access control process, someone else should audit it. Options include a trained colleague from another function, a peer from a sister company, or an external auditor engaged for the internal audit. Whatever you choose, record why the person is competent and independent.
Follow-up
An audit that ends with a report and no actions will draw questions. Log each finding, assign an owner and a due date, and feed it into corrective action under Clause 10. Bring open findings to the management review so leadership sees them.
Clause 9.3: management review
Under 9.3, top management must review the ISMS at planned intervals to make sure it remains suitable, adequate and effective. The standard sets the inputs and outputs.
Inputs include:
- Status of actions from earlier reviews.
- Changes in external and internal issues relevant to the ISMS.
- Feedback on performance, including trends in nonconformities, monitoring and measurement results, audit results and fulfilment of objectives.
- Feedback from interested parties.
- Risk assessment results and the status of the risk treatment plan.
- Opportunities for continual improvement.
Outputs must include decisions on continual improvement opportunities and any need for changes to the ISMS. Those decisions go into the minutes, which you retain as evidence.
How often?
The standard says “planned intervals” and stops there. Many organizations hold a formal review once or twice a year and use a lighter quarterly security meeting between them. Pick a rhythm you will actually keep, write it down, and hold to it. Missing a planned review is an easy finding to avoid.
Making the review real
The common failure is a review that is a slide deck read aloud and then forgotten. Send the pack a few days ahead, put decisions at the top of the agenda, and record who decided what, with owners and dates. Our management review agenda maps each 9.3 input to the evidence that fills it.
Top management must actually attend. If the CEO or managing director is absent from the minutes of every review, an auditor will notice. Reporting lines matter in larger organizations too: AT&T’s published security reference guide, for example, describes reporting security status to security executives and internal review results to executive management, the same flow Clause 9 expects of you.
Tailoring Clause 9 to startups and finance firms
The standard applies the same requirements to everyone. What changes is how heavy the machinery is.
Startups. Keep the metric set to five or six measures drawn from tools you already use: your identity provider, ticketing system, cloud console and HR system. Use a shared spreadsheet or dashboard rather than buying a platform. Combine the quarterly security meeting with a management review where the founders attend, and record decisions in a short template. Spend your scarce time on impartial internal auditing, because that is where small teams struggle most.
Finance firms. Expect more inputs. Regulatory and client expectations add monitoring needs such as vendor oversight, access recertification, incident reporting and change control evidence. AT&T’s reference guide shows how large organizations run regular internal and external reviews for regulatory, industry and privacy compliance, and finance teams can fold Clause 9 activities into the review cycles they already run rather than duplicating them. Map each existing review to a 9.1 metric, a 9.2 audit or a 9.3 input, and avoid running parallel processes. Which regulations apply to you is a question for your counsel or compliance lead.
Both groups benefit from linking Clause 9 to the controls they have chosen. Our guide to Annex A controls helps you decide which controls deserve a metric, and Clause 7 support requirements covers the competence, awareness and communication that Clause 9 depends on.
Estimating the effort to implement Clause 9
Clause 9 is mostly recurring work, so cost shows up as hours per year, not a one-time project. Four factors drive the number:
- Scope and size. More locations, systems and business units mean more metrics to collect and more audit coverage.
- Current maturity. If you already track incidents, run access reviews and keep minutes, Clause 9 is mostly formalizing. If you do not, you are building habits.
- Tooling and automation. Metrics pulled automatically from existing systems cost far less than ones assembled by hand every month.
- Internal versus external audit resources. Training an internal auditor takes time. Hiring one for each cycle takes budget.
To find your gaps, walk through each sub-clause and ask three questions: Do we have a defined process? Do we have dated evidence from at least one full cycle? Does someone other than the process owner check it? Anything answered “no” is a gap, and the number of gaps against your size gives a rough effort picture.
If you want to start quickly, the free 2-minute readiness check gives you an instant read on where you stand. For a number you can budget against, the ISO 27001 cost calculator adjusts estimates by company size, industry and maturity, and the methodology page shows how the assumptions work so you can challenge them.
Our perspective: treat Clause 9 as a feedback loop, not paperwork
We see the same pattern in organizations preparing for certification. Teams invest heavily in policies and controls, then leave Clause 9 until the last month, when they scramble to produce evidence for a year of activity that never happened. The audit finding that follows is not a documentation problem. It is a timing problem.
Our advice is to start Clause 9 early and small. Pick a handful of metrics, run one full cycle of measurement, audit and review, and write down what you learned. A single honest cycle with modest numbers is worth more than an ambitious dashboard no one reads.
We also think the planning stage deserves more attention than it gets. Most teams underestimate recurring effort because they price the build and forget the run. That is why we built our estimates around editable assumptions and benchmarks by industry: you should be able to see what drives the figure and change it. Clause 9 is the clearest example, since its cost depends so much on how much of your evidence you can collect automatically.
— Martin
Put numbers on your ISO 27001 plan
If you are budgeting for certification, Clause 9 effort belongs in the estimate next to tooling, consulting and audit fees. ISMS Calculator lets you model your own company size, industry and security maturity, run a maturity assessment across the four Annex A control themes, save several scenarios and compare them, and export a PDF report for your leadership team. The first calculation needs no signup.
Start with the ISO 27001 readiness assessment to find your gaps, or open the cost calculator to see the effort behind them.
FAQ
Is Clause 9 the same in ISO 27001:2013 and 2022?
The structure is the same: 9.1 monitoring and measurement, 9.2 internal audit and 9.3 management review. In the 2022 edition, 9.3 is split into general, inputs and results sub-clauses. Check the current text of the standard for exact wording before you update your procedures.
How often must we run internal audits?
The standard says internal audits happen at planned intervals and does not name a frequency. You define the interval in your audit program and justify it. Many organizations cover the full ISMS scope within a year, and focus more often on higher-risk areas.
Which KPIs does ISO 27001 require?
None are prescribed. You decide what to monitor and measure based on your risks and objectives, then define methods, timing and owners. Pick measures that produce comparable results over time, so that trends mean something.
Can the same person run the audit and own the process?
No. Auditors must be objective and impartial, so the person who owns or built a process should not audit it. Small companies often use a colleague from another team or an external auditor for those areas.
What records do auditors ask for in Clause 9?
Expect to show monitoring and measurement results, the internal audit program with reports and findings, and management review minutes with decisions. Keep them dated and version-controlled so you can show a full cycle.
Sources
- ISO/IEC 27001:2022, Information security management systems requirements
- ISACA implementation guide for ISO/IEC 27001:2022
- NQA, Back to Basics: ISO 27001
- NIST SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems
- AT&T Information and Network Security Customer Reference Guide