Clause 9.1 · monitoring and measurement
Same access review, two different questions
The example:
your quarterly review of who has access to what
Monitoring
Did it happen?
The review took place this quarter.
Tells you
The process ran.
Good for
Showing the control exists.
Measurement
How well?
6 of 40
accounts reviewed belonged to people who had left.
Tells you
Offboarding is leaving access open.
Good for
Deciding what to fix next.