What it asks for. The organisation must monitor, measure, analyse and evaluate its security performance and the effectiveness of the management system, run internal audits at planned intervals, and hold management reviews.
In practice. The organisation decides what to measure, how, when and who analyses the results, and uses metrics that inform decisions rather than just counting activity. An internal audit programme covers the whole scope over a cycle, using auditors who are objective and impartial. Management reviews consider the required inputs, such as audit results, risk changes, incidents and feedback, and produce decisions on improvements and resources. Evidence includes metric reports, the audit programme and reports, and minutes of management reviews.
Common gaps. Metrics often measure effort, such as patches deployed, rather than effectiveness. Internal audits are sometimes performed by the people who run the controls, and management reviews become a formality with no recorded decisions.