ISO 27001 LI · Domain 5 of 7

ISO 27001 LI Domain 5: Monitoring and Measurement of an ISMS Based on ISO/IEC 27001

The Check phase from the implementer's side: monitoring and measuring ISMS effectiveness, setting up an internal audit programme, grading and reporting nonconformities, and running management reviews that lead to decisions.

Exam weight
12.5%
Official knowledge statements
6
Estimated questions estimate
~10
Suggested study time estimate
8–10 hrs

About 12 min read Reviewed October 2026

Overview

Domain 5 tests whether an implementer can show that the ISMS works. Its six knowledge statements cover techniques for monitoring and evaluating ISMS effectiveness, concepts of measurement and evaluation, the components of an internal audit programme, the difference between major and minor nonconformities, how to draft a nonconformity report, and good practice for management reviews.

These map to clause 9 of ISO/IEC 27001:2022: 9.1 monitoring, measurement, analysis and evaluation, 9.2 internal audit with its programme in 9.2.2, and 9.3 management review with inputs in 9.3.2 and results in 9.3.3. ISO/IEC 27004 supports measurement design and ISO 19011 supports internal audit. The domain provides 10 of the 80 questions.

How it's tested

Expect questions on what clause 9.1 requires the organization to determine, whether a metric is meaningful, who may perform an internal audit, how to grade and write up a nonconformity, and which inputs or outputs a management review must cover. Many items present a flawed practice and ask what is wrong with it.

  • Good metric

    Three proposed indicators are compared and you pick the one that measures effectiveness against an objective rather than effort or volume.

  • Audit independence

    A planned internal audit assignment is judged on objectivity, competence and coverage of the audit programme.

  • Review completeness

    A management review agenda or minutes are checked against the inputs in 9.3.2 and the results in 9.3.3.

Reasoning it through

A company's management review minutes list attendees, a summary of the security dashboard and a note that all is fine. The question asks the main deficiency. Reason with clause 9.3.3: results must include decisions on continual improvement opportunities and any needs for changes to the ISMS, retained as documented information. The minutes record inputs but no decisions, so the best answer names missing outputs.

Knowledge statements 6

Official knowledge statements from the PECB outline, in outline order.

5.1 The best practices and techniques used to monitor and evaluate the effectiveness of an ISMSHow the organization checks its ISMS performs.
What it means
Clause 9.1 requires the organization to determine what needs to be monitored and measured, the methods, when monitoring and measuring is performed, who performs it, when results are analysed and evaluated, and who analyses and evaluates them. It must evaluate information security performance and ISMS effectiveness.
What to understand
Techniques include dashboards, key performance and risk indicators, log analysis, vulnerability scans, control self-assessments, technical testing, incident trend analysis and supplier reviews. Methods should produce comparable and reproducible results. Monitoring watches status continuously, while evaluation judges results against criteria and objectives.
How it shows up
Expect questions listing clause 9.1 elements and asking which one a scenario has failed to define.
Common confusion
Treating collecting data as the same as analysing and evaluating it.
5.2 The concepts related to measurement and evaluationMeasures, indicators and evaluation criteria.
What it means
Measurement assigns values to attributes, such as the percentage of laptops encrypted. Evaluation compares those values against targets or criteria to judge performance. ISO/IEC 27004 distinguishes performance measures, about how processes run, from effectiveness measures, about whether intended results are achieved.
What to understand
Good measures are linked to objectives, have a defined formula, data source, frequency, owner and target, and are reported to the right audience. Base measures combine into derived measures and indicators. Too many metrics dilute attention; a small set aligned to clause 6.2 objectives works better.
How it shows up
Questions ask which metric best evaluates the effectiveness of a given control or objective.
Common confusion
Choosing an activity count, like number of trainings delivered, as an effectiveness measure.
5.3 The main concepts and components related to the implementation and operation of an ISMS internal audit programPlanning and running internal audits under clause 9.2.
What it means
Clause 9.2 requires internal audits at planned intervals to check conformity with the organization's own requirements and the standard, and effective implementation. Clause 9.2.2 requires an audit programme with frequency, methods, responsibilities, planning requirements and reporting, considering the importance of processes and previous audit results.
What to understand
For each audit, criteria and scope are defined, auditors are selected to ensure objectivity and impartiality, results are reported to relevant management, and documented evidence is retained. Internal audits may be outsourced. ISO 19011 provides guidance on audit principles, programme management and auditor competence.
How it shows up
Expect scenarios where an auditor audits their own work, or where the programme ignores high-risk processes.
Common confusion
Believing internal auditors must be external consultants to be impartial.
5.4 The difference between a major and a minor nonconformityGrading nonfulfilment of requirements.
What it means
A nonconformity is nonfulfilment of a requirement. A major nonconformity affects the capability of the ISMS to achieve its intended results, for instance when a required process is absent or fails systematically. A minor nonconformity is a lapse that does not affect that capability.
What to understand
Grading terms come from certification practice in ISO/IEC 17021-1, but implementers use them in internal audits to prioritize. Several related minors in one process may indicate a systemic breakdown and justify a major. Observations or opportunities for improvement are not nonconformities.
How it shows up
Questions describe a finding, such as no risk assessment ever performed, and ask its grade.
Common confusion
Grading a single late record as major because the topic sounds important.
5.5 The guidelines and best practices to draft a nonconformity reportWriting a clear, evidence-based finding.
What it means
A nonconformity report states the requirement not met, the objective evidence observed, and the nature of the nonconformity, plus the grade, location or process, date and auditor. It should be clear enough that someone not present understands the issue and can act.
What to understand
Good reports are factual, specific and traceable, referencing the clause or control and the organization's own policy where relevant. They avoid opinion, blame and prescribed solutions. The auditee acknowledges the finding and is responsible for correction, root cause analysis and corrective action.
How it shows up
Expect items comparing three finding statements and asking which is best written.
Common confusion
Including the recommended fix in the nonconformity statement.
5.6 The best practices used to perform management reviewsTop management's periodic review under clause 9.3.
What it means
Top management reviews the ISMS at planned intervals to ensure continuing suitability, adequacy and effectiveness. Inputs include status of previous actions, changes in external and internal issues, changes in needs and expectations of interested parties, performance feedback, interested party feedback, risk assessment and treatment status, and improvement opportunities.
What to understand
Performance feedback covers nonconformities and corrective actions, monitoring and measurement results, audit results and fulfilment of objectives. Results must include decisions on continual improvement and any changes needed, retained as documented information. Good reviews are prepared in advance, use concise data, and assign owners and dates to decisions.
How it shows up
Questions ask which item is a required input or what the review must produce.
Common confusion
Delegating management review entirely to the information security manager.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Clause 9.1 elements

    What, methods, when, who measures, when analysed, who evaluates.

    Remember
    Six determinations required.
    Tested as
    Missing-element items.
    Trap
    Forgetting who evaluates results.

  • Effectiveness measure

    Indicator showing whether intended results are achieved.

    Remember
    Linked to objectives and outcomes.
    Tested as
    Metric selection.
    Trap
    Counting activities instead of results.

  • ISO/IEC 27004

    Guidance on monitoring, measurement, analysis and evaluation.

    Remember
    Guidance, not requirements.
    Tested as
    Reference standard items.
    Trap
    Confusing it with ISO/IEC 27005.

  • Audit programme

    Planned set of audits with frequency, methods and responsibilities.

    Remember
    Considers importance of processes and previous results.
    Tested as
    Clause 9.2.2 items.
    Trap
    Auditing every process equally regardless of risk.

  • Auditor objectivity

    Freedom from bias and conflicts of interest.

    Remember
    Auditors do not audit their own work.
    Tested as
    Assignment scenarios.
    Trap
    Requiring external auditors only.

  • Major nonconformity

    Affects ISMS capability to achieve intended results.

    Remember
    Absent process or systemic failure.
    Tested as
    Grading items.
    Trap
    Over-grading isolated lapses.

  • Minor nonconformity

    Requirement unmet without affecting overall capability.

    Remember
    Still needs corrective action.
    Tested as
    Grading items.
    Trap
    Ignoring repeated minors.

  • Nonconformity statement

    Requirement, evidence and nature of the gap.

    Remember
    Factual and traceable, without solutions.
    Tested as
    Report quality items.
    Trap
    Adding recommendations.

  • Management review inputs

    Required topics listed in 9.3.2.

    Remember
    Includes changes in interested party needs, added in 2022.
    Tested as
    Agenda completeness.
    Trap
    Leaving out risk treatment status.

  • Management review results

    Decisions on improvement and ISMS changes.

    Remember
    Retained as documented information.
    Tested as
    Output items.
    Trap
    Minutes with no decisions.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Monitoring vs. measurement vs. evaluation

ConceptMeaningKey differenceCommon trap
Monitoring Determining status of a system, process or activity Ongoing observation Assumed to include judgement
Measurement Process to determine a value Produces numbers Metrics without targets
Evaluation Judging results against criteria or objectives Leads to conclusions and action Skipped after data collection

Internal audit vs. management review

ConceptMeaningKey differenceCommon trap
Internal audit Independent check of conformity and effective implementation Performed by objective auditors Run by process owners on their own areas
Management review Top management assessment of suitability, adequacy and effectiveness Makes decisions on changes and improvement Treated as a status meeting

Major vs. minor nonconformity in internal audits

ConceptMeaningKey differenceCommon trap
Major Missing or systematically failing requirement Threatens intended outcomes Applied to single slips
Minor Isolated lapse in a working process Does not threaten intended outcomes Left without corrective action

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Activity metric

    What candidates pick
    Number of awareness sessions held per year.
    Why it looks right
    It is easy to count and report.
    Why it's wrong
    It measures effort, not whether behaviour or security outcomes improved, so it says little about effectiveness.

    Clue to watch for Question asks about effectiveness of a control.

  2. Self-audit

    What candidates pick
    The ISMS manager audits the risk process they built.
    Why it looks right
    They know the process best.
    Why it's wrong
    Clause 9.2.2 requires auditors selected to ensure objectivity and impartiality; auditing your own work undermines both.

    Clue to watch for Auditor designed or runs the audited process.

  3. External auditors only

    What candidates pick
    Internal audits must be done by an external firm.
    Why it looks right
    External parties seem more impartial.
    Why it's wrong
    Internal staff from other areas can audit objectively; outsourcing is allowed but not required.

    Clue to watch for Options use words like must or only.

  4. Solution in the finding

    What candidates pick
    Write the nonconformity with the required fix.
    Why it looks right
    It seems helpful to the auditee.
    Why it's wrong
    Findings state requirement, evidence and gap; the auditee determines root cause and corrective action.

    Clue to watch for Option begins with should implement.

  5. Review without decisions

    What candidates pick
    Minutes summarizing reports satisfy clause 9.3.
    Why it looks right
    The meeting took place.
    Why it's wrong
    Clause 9.3.3 requires results including decisions on improvement and ISMS changes, kept as documented information.

    Clue to watch for Minutes contain no actions or decisions.

  6. Data equals evaluation

    What candidates pick
    Collecting SIEM logs fulfils clause 9.1.
    Why it looks right
    Logs show monitoring exists.
    Why it's wrong
    The organization must also analyse and evaluate results and define who does it and when.

    Clue to watch for Scenario shows data collected but never reviewed.

Answer framework

For Check-phase questions, ask whether the ISMS is producing evidence, judging it objectively and turning it into management decisions.

  1. Check that clause 9.1 determinations exist: what is measured, the method, timing, who measures, when analysis occurs and who evaluates results.
  2. Test each metric by asking whether it shows an objective being achieved rather than effort being spent.
  3. Verify the internal audit programme considers risk and past results, and that auditors are objective, impartial and competent for the area.
  4. For findings, confirm requirement, evidence and nature are stated, grade by effect on intended outcomes, and leave solutions to the auditee.
  5. Check that management review covers every 9.3.2 input and produces recorded decisions on improvement and needed changes to the ISMS.

Practice question

An organization sets the objective of revoking all leaver access within one working day. The ISMS manager proposes indicators for the monthly dashboard. Which indicator best evaluates whether this objective is being achieved?

Want more like this? The ISO 27001 LI practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Read clause 9 of ISO/IEC 27001:2022 slowly and list every 'shall' as a checklist. Then skim ISO/IEC 27004 for its examples of measures, and ISO 19011 clause 5 on audit programmes. These three sources cover nearly every question in this domain.

Next, build a small measurement set for a fictional ISMS: six indicators tied to three objectives, each with formula, data source, frequency, owner, target and reporting audience. Rewrite any indicator that only counts activity. This exercise trains you to spot weak metrics among exam options.

Then design a one-year internal audit programme for a company with five key processes, assigning auditors so nobody audits their own work. Write five nonconformity statements from short descriptions and grade each. Finally, draft a management review agenda that maps each item to 9.3.2 and add a results section with decisions and owners. Practise questions in blocks of ten and track which clause 9 requirement each miss involved.

FAQ

What weight does Domain 5, Monitoring and Measurement of an ISMS Based on ISO/IEC 27001, carry?

It has 10 of the 80 questions in PECB's handbook, which equals 12.5% of the exam.

Must internal auditors be certified lead auditors?

No. They must be competent, objective and impartial. Training in ISO 19011 helps, but the standard does not require a specific certificate.

Can a small company audit itself internally?

Yes. Staff can audit areas they do not work in, or the company can use an external party. The key is that auditors do not audit their own work.

What changed in clause 9 in the 2022 edition?

Clause 9.2 and 9.3 were split into subclauses, management review gained the input on changes in needs and expectations of interested parties, and clause 9.1 now states in its main text that selected methods should produce comparable and reproducible results.

Why does an implementer exam test nonconformity grading?

Implementers run internal audits and prepare for certification, so they must prioritize findings and understand how a certification auditor will grade gaps found at Stage 2.

How often must management review happen?

At planned intervals set by the organization. Annual reviews are common, often before certification and surveillance audits, but the standard does not fix a frequency.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

Check whether you can design meaningful ISMS metrics, run an objective internal audit programme and spot gaps in a management review.

Take the ISO 27001 LI practice test Check your ISO 27001 LI readiness

Keep going