ISO 27001 · Clause 9

Three parts, and each one feeds the next

9.1
Monitoring and measurement

Track a small set of security metrics and work out what the numbers say.

Passes on

Numbers, and what they mean

9.2
Internal audit

Check the system against the standard and against your own rules.

Passes on

Findings, written up

9.3
Management review

Top management looks at all of it and decides what changes.

Passes on

Decisions about the ISMS

Decisions set the next round