ISMS Performance Report Template (ISO/IEC 27001 9.1, 9.3)

ISMS Performance Report: [Organization name], [Period]

Periodic report to top management on the performance and effectiveness of the information security management system (ISMS) of [Organization name]. It presents the results of monitoring and measurement required by ISO/IEC 27001:2022 + Amd 1:2024 clause 9.1 and supplies inputs to the management review in clause 9.3: KPI trends, objectives status, risks, incidents, audit results and actions, with a one-page dashboard. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Executive summary
2. Key performance indicators
3. Information security objectives
4. Risk position
5. Security incidents
6. Audits and compliance
7. Actions and improvement
8. Changes, resources and interested parties
9. Decisions requested
10. One-page dashboard
11. Size tiers
12. Records and evidence
13. References

1. Executive summary

Overall ISMS status (Example): Amber. 16 of 20 KPIs are green, 3 amber and 1 red. Critical vulnerability remediation reached target for a second quarter. Phishing click rate (MET-012) is red at 9.4% after a harder simulation, and corrective actions closed on time (MET-018) are amber at 85%. One Critical risk remains open (RISK-031, colocation power redundancy) with treatment due next quarter. No severity 1 incident occurred. The first internal audit cycle is complete with 3 minor nonconformities and no major ones.

Decisions requested: approve targeted phishing training for two teams, approve funding for the colocation power upgrade, and confirm the date of the management review (section 9).

2. Key performance indicators

Status: G green (at or better than target), A amber (within tolerance), R red. Trend compares the current quarter with the previous one: up means better, down means worse, flat means no material change.

Status count for 2027-Q3 (Example): 16 green, 3 amber (MET-018, MET-020, MET-023), 1 red (MET-012), total 20.

2.1 Commentary on amber and red KPIs

3. Information security objectives

Objectives on track (Example): 5 of 6 green, which is 83% and matches MET-022.

4. Risk position

Bands (DOC-ISMS-010): Low 1 to 4, Medium 5 to 9, High 10 to 16, Critical 17 to 25 (in practice 20 and 25).

How the movements add up (Example): for each band, previous + new + moved in - moved out - closed = this report (for High: 9 + 1 + 1 - 3 - 1 = 7). Moves are re-scorings after treatment: one Critical risk fell to High, three High risks fell to Medium and two Medium risks fell to Low, so moves in and moves out both total 6. Three new risks entered and three were closed, so the total stays at 48.

4.1 Top risks

4.2 Risk acceptances

Record new acceptances in the risk acceptance record (isms/isms-risk-acceptance-record, DOC-ISMS-019).

5. Security incidents

Mean time to contain severity 1 and 2 in 2027-Q3 (Example): (5 + 8) / 2 = 6.5 hours, as reported in MET-016.

6. Audits and compliance

Compliance status (Example): no new legal or regulatory requirement entered the legal register (DOC-ISMS-014) this period; one customer contract added a 24-hour incident notice, now reflected in the incident response plan (DOC-ISMS-020).

7. Actions and improvement

Check: open at end = open at start + raised - closed (29 + 21 - 20 = 30). Overdue items: [list IDs and owners].

8. Changes, resources and interested parties

9. Decisions requested

Total funding requested (Example): 48,000 + 3,500 + 39,000 = 90,500 USD. Use your local currency.

10. One-page dashboard

The layout below fits one printed page or one slide. Every figure on it comes from sections 2 to 9; update the dashboard last, after the detailed sections are final.

+------------------------------------------------------------------+
| ISMS PERFORMANCE  2027-Q3   Quillmere Health Systems (Example)   |
| Overall status: AMBER    KPIs: 16 G / 3 A / 1 R (20)             |
+-------------------------------+----------------------------------+
| HEADLINE KPIs        Q3  Trend| RISK POSITION   prev -> now      |
| Leaver access      98.6%  =   | Critical          2 -> 1         |
| Critical vulns SLA 96.0%  =   | High              9 -> 7         |
| Endpoint baseline  97.3%  ^   | Medium           20 -> 22        |
| Phishing click      9.4%  v R | Low              17 -> 18        |
| Phishing report      61%  ^   | Total            48 -> 48        |
| CAPA on time         85%  v A |                                  |
+-------------------------------+----------------------------------+
| INCIDENTS  S1 0  S2 2  S3 11  S4 34  (total 47)                  |
| AUDITS     Internal: 0 major, 3 minor, 6 obs.  Stage 1 done      |
| OBJECTIVES 5 of 6 on track (83%)                                 |
+------------------------------------------------------------------+
| DECISIONS: 1 Colocation power (48k)  2 Phishing training (3.5k)  |
|            3 Segmentation contractor (39k)  4 Review date        |
+------------------------------------------------------------------+

11. Size tiers

12. Records and evidence

Link these records in the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033) under clauses 9.1 and 9.3.

13. References

Related templates: isms/isms-measurement-programme (DOC-ISMS-080), compliance/management-review (DOC-ISMS-085), compliance/objectives-register (DOC-ISMS-024), compliance/risk-register (DOC-ISMS-016), isms/isms-risk-acceptance-record (DOC-ISMS-019), isms/incident-register (DOC-ISMS-021), isms/audit-findings-register (DOC-ISMS-086), isms/isms-steering-committee-charter (DOC-ISMS-007), security/security-metrics-report.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.1 and 9.3, with reporting ideas informed by ISO/IEC 27004:2016. The text, dashboard layout, KPIs and all figures are original and illustrative; no ISO or IEC text, tables or definitions are reproduced, and you need the official standards to apply the requirements. ISO and IEC standards are copyrighted and sold by ISO, IEC and national standards bodies. Check the current edition and amendments before use. Template licence: MIT.