Security Policy: Difference between revisions

The organization shall determine:

:1. what needs to be monitored and measured, including information security processes and controls;

:2. the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;

:3. when the monitoring and measuring shall be performed;

:4. who shall monitor and measure;

:5. when the results from monitoring and measurement shall be analysed and evaluated; and

:6. who shall analyse and evaluate these results.