metrics

ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation

Clause 9.1 requires you to measure whether your ISMS and controls actually work. What to monitor, how to define metrics that pass audit, and what evidence to keep.