Question:An organization has compared its actual performance against predetermined performance targets.

ISO/IEC 27001:2022 Clause 9.1 – Monitoring, measurement, analysis, and evaluation:

“The organization shall evaluate the performance and effectiveness of the information security management system. The evaluation shall include... comparison against performance indicators and security objectives.”

The purpose is to ensure that security objectives (Clause 6.2) are being met. Measuring performance allows organizations to determine whether controls and processes are effective and aligned with strategic goals.

Option A is too narrow, and Option C is incorrect because manual tracking may still be required in some cases.