9.1 Monitoring, measurement, analysis and evaluation

Clause 9.1 requires organizations to establish processes for monitoring, measuring, analyzing and evaluating the performance of their security management system, ensuring that security objectives are achieved, compliance is maintained, and opportunities for continual improvement are identified.