What it asks for. This clause expects the organisation to evaluate information security performance and the effectiveness of the management system. It must decide what is monitored and measured, the methods, when it happens, who does it and who analyses the results.
In practice. Good practice means a small set of meaningful measures linked to objectives and risks, such as patch timeliness, incident trends or training effectiveness, with defined data sources and owners. Results are analysed and reported to management and drive decisions. Auditors expect documented evidence of results and of how they were evaluated.
Common gaps. Common gaps are measures chosen because they are easy rather than useful, no targets or analysis and results that never reach management review.