Skip to content

Process for Monitoring, Measurement, Analysis and Evaluation

Purpose. Defines what Soon monitors and measures to evaluate the performance and effectiveness of the ISMS (ISO/IEC 27001:2022 clause 9.1). Kept lean and automatable for a small team.

1. What we measure

For each metric: what is measured, how/method, when/frequency, who, and the target. Results feed the Management Review.

# Metric Method / source Frequency Owner Target
M1 Document approval coverage tools/isms.py / STATUS.md (% approved) Monthly ISM 100% of applicable docs approved before audit
M2 Overdue document reviews STATUS.md (next_review) Monthly ISM 0 overdue
M3 Open high risks (untreated) Risk Assessment Report Quarterly ISM 0 untreated High
M4 Security incidents (by severity) Incident records Per incident + quarterly trend ISM Downward trend; all P1/P2 reviewed
M5 Time to detect / respond to incidents Incident records Per incident Tech Lead Within severity targets
M6 Patch / vulnerability remediation time Aikido / vuln tooling Monthly Tech Lead Criticals within agreed SLA
M7 Access reviews completed JML / access review records Quarterly Tech Lead 100% on schedule
M8 Backup restore test success Restore test records Quarterly Tech Lead 100% successful
M9 Security awareness completion Training records Per cycle ISM 100% of staff
M10 Supplier reviews completed Supplier register Annual ISM 100% of key suppliers
M11 Platform availability / uptime Monitoring (CloudWatch) Monthly Tech Lead Meets SLA TODO(owner)
M12 Corrective actions closed on time CAPA log Quarterly ISM 90%+ on time

TODO(owner): confirm targets/SLAs and tooling sources for each metric.

2. Analysis & evaluation

The ISM consolidates results, identifies trends and deviations from target, and evaluates whether the ISMS is achieving its objectives. Significant deviations are raised as nonconformities or improvement opportunities.

3. Reporting

Results are presented at the Management Review and summarised in the auto-generated STATUS dashboard where applicable. Retained as documented evidence of monitoring.

Change log

Version Date Author Comments
0.1 2026-06-25 Andrea Cardinali / ISMS First draft — 12 ISMS metrics with owners/frequency; targets/SLAs flagged TODO.