ISO27001 Clause 9.1 Certification Guide | Monitoring, Measurement, Analysis, Evaluation

What is ISO27001 Clause 9.1?

ISO27001 Clause 9.1 Monitoring, Measurement, Analysis, Evaluation requires an organisation to implement measures and monitors to evaluate the effectiveness of the information security management system. It is a requirement to maintain evidence of the results of measures and monitors.

The ISO27001 standard for ISO27001 certification wants you to ensure the effective operation of the management system and to implement appropriate analysis and evaluation of the measures and monitors. It is one of the ISO27001 controls.

What are the ISO27001:2022 Changes to Clause 9.1?

There are clarification changes to the ISO27001 Clause 9.1 in the 2022 update.

• The words about the organisation evaluations the information security performance and the effectiveness of the management system have been removed. They are covered to a greater or lesser degree elsewhere in the clause.
• 9.1 b has been updated to give guidance on the methods of monitoring, measurement, analysis and evaluation and provides that they should produce comparable results and reproducible results to be considered valid. This was previously a footnote so no material change.
• 9.1 e has had the word ‘and’ removed with little to no consequence.
• A requirement for documented information to be available to evidence results has been included making it an explicit rather than implied requirement.
• Rather than retain appropriate documentation as evidence the line has been replaced with the requirement to evaluate the information security performance and effectiveness of the information security management system.

It says pretty much the same thing, with the same requirement with a change to the wording of how it says it.

ISO27001 Clause 9.1 Definition

The ISO27001 standard defines clause 9.1 as:

The organisation shall determine:

a) what needs to be monitored and measured, including information security processes and controls;

b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results. The methods selected should produce comparable and reproducible results to be considered valid.

c) when the monitoring and measuring shall be performed;

d) who shall monitor and measure;

e) when the results from monitoring and measurement shall be analysed and evaluated;

f) who shall analyse and evaluate these results.

Documented information shall be available as evidence of the results.

The organisation shall evaluate the information security performance and effectiveness of the information security management system.

ISO27001 Clause 9.1 Monitoring, Measurement, analysis, evaluation

ISO27001 Annex A / ISO27002 2022 Guidance

There is further guidance provided in the ISO27001 Annex A Controls that was revised in 2022 with changes to the ISO27002 standard and specifically calls out required monitoring and analysis. As you would expect this a fundamental area for an information security management system and as such it touches most of the controls. Here will look at some actual specifics and take a look at what Annex A says.

ISO27002 Clause 5.7 Threat Intelligence

Information relating to information security threats should be collected and analysed to produce threat intelligence.

ISO27002 Clause 5.7 Threat Intelligence

This is a new ISO27002 control introduced in 2022. Whilst not a direct measure and monitor it is an indirect measure and monitor that allows an organisation to gather threat intelligence to more effectively understand risk, what controls may be required and better protect itself.

ISO27002 Clause 8.15 Logging

Logs that record activities, exceptions, faults and other relevant events should be produced, stored, protected and analysed.

ISO27002 Clause 8.15 Logging

Logging is one of the more straight forward measures and monitors that we can introduce and is often provided as a default capability of most applications and systems.

ISO27002 Clause 5.22 Monitoring, review and change management of supplier services

The organization should regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

ISO27002 Clause 5.22 Monitoring, review and change management of supplier services

Supply chain security represents one of the biggest risks to any organisation as it is something that is outside your direct control. Ensuring a regular review and monitoring of their security practices and service delivery seeks to gain assurance that they are doing the right thing for information security and therefore protecting you, your customers and your clients.

ISO27002 Clause 7.5 Physical security monitoring

Premises should be continuously monitored for unauthorized physical access.

ISO27002 Clause 7.5 Physical security monitoring

The requirements of ISO27002 clause 7.5 are satisfied by physical controls such as locked doors, manned reception areas, visitor cards, escorted visitors, potentially CCTV cameras and alarms. This is traditional security around access to physical locations.

ISO27002 Clause 8.6 Capacity Management

The use of resources should be monitored and adjusted in line with current and expected capacity requirements.

ISO27002 Clause 8.6 Capacity Management

Monitoring, reporting, analysing and responding to capacity management is specifically aimed at the availability aspect of information security. Ensuring that information and systems are available when required and negating any unintended consequences of exceeding the capacity capabilities of those systems.

ISO27002 Clause 8.9 Configuration Management

Configurations, including security configurations, of hardware, software, services and networks should be established, documented, implemented, monitored and reviewed.

ISO27002 Clause 8.9 Configuration Management

ISO27002 Clause 8.15 Logging

Logs that record activities, exceptions, faults and other relevant events should be produced, stored, protected and analysed.

ISO27002 Clause 8.15 Logging

Similar to the next clause, 8.16 monitoring actives, this clause on logging is a bit of a catch all clause.

ISO27002 Clause 8.16 Monitoring Activities

Networks, systems and applications should be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.

ISO27002 Clause 8.16 Monitoring Activities

We have seen some specific requirements on measures and monitors but now we enter what we call a ‘catch all’ clause that basically says monitor everything. There is an art and a science in actually deciding and justifying what you monitor so as not to have monitoring overload.

ISO27002 Clause 8.21 Security of Network Services

Security mechanisms, service levels and service requirements of network services should be identified, implemented and monitored.

ISO27002 Clause 8.21 Security of Network Services

ISO27002 Clause 8.30 Outsourced Development

The organization should direct, monitor and review the activities related to outsourced system development.

ISO27002 Clause 8.30 Outsourced Development

This is one of the few clauses in the statement of applicability that is often not applicable, especially if you do not outsource your software development or do software development. If you do then monitoring and review is required.

How to comply with ISO27001 Clause 9.1

ISO27001 Clause 9.1 Implementation Guide

There are many ways to implement measures and monitors and what is right for you will depend on your company culture and the tools available.

Consider the best methods for you that you know get results and where possible retain evidence of your measures and monitors.

Technical tools are great but also consider the manual reviews, checks and balances and consider for the manual processes how you will record them and evidence them.

How do you demonstrate compliance to ISO27001 clause 9.1?

You demonstrate compliance to ISO27001 Clause 9.1 by having in place measures and monitors that you can show to an auditor and evidence of the operation of those measures and monitors with historical reports that show historic results.

ISO27001 Clause 9.1 Templates

ISO27001 templates are a great way to implement your information security management system. Whilst an ISO27001 toolkit can save you up to 30x in consulting fees and allow you to deliver up to 10x faster these individual templates help meet the specific requirements of ISO27001 clause 9.1

ISO27001 Clause 9.1 FAQ

Reference

ISO/IEC 27001 Information Security Management