9.1 Monitoring, measurement, analysis and evaluation
Determine what needs monitoring and measuring, the methods that will produce valid results, and when and by whom measurement is performed and when and by whom the results are analysed and evaluated; retain the results as
4
artefacts
0
held by a system
0
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Defined measurement set with method, frequency and responsible person for measurement and for analysis · Document repository
- Retained measurement results · Document repository
- Evaluation of BCMS performance and effectiveness drawn from those results · Document repository
- Justification that the methods produce valid, comparable results · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Activity counted rather than effectiveness measured, so the metrics cannot show whether the BCMS works
- Measurement performed but never analysed, with results filed unread
- Different methods used across periods, making the trend meaningless
- Analysis responsibility unassigned, so measurement stops at collection
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.6 Evaluation of business continuity documentation and capabilities · 9.2 Internal audit