9. Performance evaluation

9.1 Monitoring, measurement, analysis and evaluation

What is measured	How	When	Who
The objectives	KPI value recorded in each objective issue	Every ISMS security meeting	Owner of the objective
Progress of risk treatment	Open actions in the risk register	Every ISMS security meeting	Information Security Officer
Recurring checks	Recurring task issues closed in their period, with outcome	Every ISMS security meeting	Information Security Officer
Effectiveness of the ISMS as a whole	Internal audit and management review	Yearly	Internal auditor, Management

Where a measurement can be automated (a report from GitLab, monitoring or a scanner), the meeting uses that report. Each meeting records its evaluation in its issue; that issue is the evidence.

9.2 Internal audit

• An internal audit takes place every year, before the external audit, as a recurring task.
• The Internal auditor is an external person, so nobody audits their own work.
• The audit programme runs in three-year cycles. Every year the audit covers clauses 4 to 10 and the secure development controls (Annex A 8.25 to 8.31). The other Annex A controls are spread over the three years, so each control is audited at least once per cycle.
• The auditor works like a certification auditor: interviews with the role holders, checks of the evidence in GitLab, and a short audit report stored in the audit issue.
• Findings are classified the way certification bodies do:
  • Major non-conformity: a requirement that is essential to the standard is not met, for example no risk assessment, no objectives or no internal audit, or several minor non-conformities on the same topic.
  • Minor non-conformity: a requirement is not met in an isolated case, for example two of twenty risks without a treatment plan.
  • Observation: no problem yet, but it may become a non-conformity.
  • Opportunity for improvement: a suggestion; we decide what to do with it.
• Non-conformities go to the non-conformity register and are handled as described in improvement.

9.3 Management review

• Management reviews the ISMS once a year, after the internal audit, as a recurring task.
• The agenda covers the inputs the standard requires: actions from the previous review, changes in internal and external issues and in the needs of interested parties, the performance of the ISMS (non-conformities, measurement results, audit results, objectives), feedback from interested parties, the risk assessment and treatment, and opportunities for improvement.
• The outcome is decisions on improvements and on changes to the ISMS, including its resources and objectives. The minutes are kept in the review issue.