Fulfilling the ISO/IEC 27001 requirements

What the published 2016 guidance says

Clause 9.1 of the 2013 requirement standard asks the organization to judge security performance and management system effectiveness. To do that it must settle six questions: which processes and controls are watched and measured; which methods are used, so that the result is valid; when the watching and measuring happen; who performs them; when the findings are read and judged; and who reads and judges them. It also requires records of the findings. The guidance notes that a valid method gives results that can be compared and repeated, and maps each of the six questions to its own clauses.

What it means in practice

The requirement asks for six determinations: what, how, when, who measures, when the results are analysed, and who analyses them. Write them down as six answers, not as a sentence in a procedure. The seventh duty, retaining the results, is where most programmes are thinnest.

What good looks like

Put the six determinations in a table: what, method, when measured, who measures, when analysed, who analyses. Add the retention rule and the location of the results. Review the table at the same time as the risk treatment plan.

Evidence an assessor asks for

• Performance evaluationA documented determination of what is monitored and measured, the methods, the timing and the roles for measuring and for analysing
• GovernanceRetained records of monitoring and measurement results

The question an assessor will ask

An assessor will ask for A documented determination of what is monitored and measured, the methods, the timing and the roles for measuring and for analysing. The test for 5.2 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

• The six determinations of 9.1 answered implicitly in a tool rather than determined and documented
• Analysis and evaluation assigned to nobody, so results are collected and never evaluated

Before the next review

Before the next review, test this against one live record: the six determinations of 9.1 answered implicitly in a tool rather than determined and documented.

What to check when the revision publishes

When DIS 27004 is published, compare the 5.2 Fulfilling the ISO/IEC 27001 requirements record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.