Performance Measurement, Testing and Monitoring of Controls
Domain 5 tests how you prove controls actually work: monitoring, measurement, analysis, evaluation, internal audit, management review and improvement. Expect questions distinguishing an activity metric from an effectiveness measure.
Requirements and guidance
27001 clause 9.1 requires the organization to determine what to monitor and measure, the methods, when, by whom, and when results are analysed and evaluated. Clause 9.2 requires a planned internal audit programme; 9.3 requires management review with defined inputs and outputs; clause 10 requires correction and corrective action with root-cause analysis. ISO/IEC 27004 gives guidance on measurement constructs: measurand, measurement method, result, indicator, decision criteria and reporting.
Measuring controls
Define the question first, then the metric. Each metric needs a data source, a denominator, an owner, a frequency and decision criteria that trigger action. Pair leading indicators (patch backlog trend) with lagging indicators (incident counts). Test design effectiveness (is it designed correctly?) and operating effectiveness (did it run as designed over the period?), using sampling and retained evidence.
Monitoring and testing controls in 27002
A.5.35 independent review, A.5.36 compliance with policies and standards, A.8.8 vulnerability management, A.8.15 logging, A.8.16 monitoring activities, A.8.29 security testing in development and acceptance.
Worked example
Metric: critical vulnerabilities remediated within 14 days. Reasoning: define critical as CVSS base score >= 9.0; source data from scanner plus ticketing system; denominator = all critical findings closed that month; decision criteria: >=95% green, 85-94% amber with a plan, <85% red requiring corrective action at management review. Counting scans run measures effort, not effectiveness, and supports no decision.
Traps
Reporting effort (scans, trainings) as effectiveness; omitting decision criteria so data drives no action; using internal audit only to check IT; holding management review with no recorded decisions; testing a control once at go-live and never again.