Frameworks / ISO/IEC 42001:2023 / 9.1 ISO/IEC 42001:2023
Performance evaluation – ISO/IEC 42001:2023
ISO/IEC 42001:2023 9.1: Monitoring, measurement, analysis and evaluation Decide what to monitor and measure, the methods that give valid results, when monitoring and measurement happen and when results are analysed and evaluated; keep documented evidence of results and evaluate the performance and effectiveness of the AIMS.
Maintained by Gerard Blokdyk · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 65 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated 10.4.2 10.4.2 Periodic review of all other system component logs 10.7.1 10.7.1 Service providers detect critical control failures (superseded) 10.7.2 10.7.2 Detect and alert on critical security control failures 10.7.3 10.7.3 Respond promptly to critical security control failures 11.4.4 11.4.4 Correct exploitable findings from penetration tests 5.22 Monitoring, review and change management of supplier services 5.36 Compliance with policies, rules and standards for information security 8.16 Monitoring activities 8.6 Capacity management SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13) SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies 5.22 Monitoring, review and change management of supplier services 5.36 Compliance with policies, rules and standards for information security 8.16 Monitoring activities ISO30401-11 Monitoring, measurement, and analysis ISO30401-9.1 Monitoring, measurement, analysis, evaluation ISO-37002-9.1 Monitoring, measurement, analysis and evaluation ISO37002-9.1 Monitoring, Measurement, Analysis, Evaluation ISO-39001-9.1 Monitoring, measurement, analysis and evaluation ISO39001-9.1 Monitoring, Measurement, Analysis, and Evaluation ISO-41001-9.1 Monitoring, measurement, analysis and evaluation ISO41001-9.1 Monitoring, Measurement, Analysis, and Evaluation ISO-50001-9.1 Monitoring, measurement, analysis and evaluation of energy performance 9.1 Monitoring, measurement, analysis and evaluation of energy performance and the EnMS ISO-56002-9.1 Monitoring, measurement, analysis and evaluation ISO56002-9.1 Monitoring, measurement, analysis and evaluation 27003-9.1 Monitoring, Measurement, Analysis, Evaluation ISO27003-9.1 Monitoring, measurement, analysis and evaluation AS9100D-9.1 Monitoring, Measurement, Analysis, Evaluation CA-7 Continuous Monitoring CA-7 Continuous Monitoring 9.1 Monitoring, measurement, analysis and evaluation 9.1 Monitoring, measurement, analysis and evaluation 9.1 Monitoring, measurement, analysis and evaluation ISO-22313-9.1 Monitoring, measurement, analysis and evaluation 5.7.1 Monitoring, measurement, analysis and evaluation 9.1 9.1 Monitoring, measurement, analysis and evaluation 9.1 Monitoring, measurement, analysis and evaluation 9.1 Monitoring, measurement, analysis and performance evaluation 9.1 Monitoring, measurement, analysis and evaluation 9.1 Monitoring, measurement, analysis and evaluation Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Performance evaluation – ISO/IEC 42001:2023 You are reading one control. How much of ISO/IEC 42001:2023 have you already done? ISO/IEC 42001:2023 9.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.
Query this from an agent The graph holds this control, the 65 it maps to, and the evidence behind each claim, over MCP and REST.