# ISMS Performance Report: [Organization name], [Period]

> Periodic report to top management on the performance and effectiveness
> of the information security management system (ISMS) of
> [Organization name]. It presents the results of monitoring and
> measurement required by ISO/IEC 27001:2022 + Amd 1:2024 clause 9.1 and
> supplies inputs to the management review in clause 9.3: KPI trends,
> objectives status, risks, incidents, audit results and actions, with a
> one-page dashboard. Replace every `[bracketed]` value and every row
> marked *Example*.

<!--
Guidance: How to use this template
- When to use: every reporting period set in the measurement programme
  (DOC-ISMS-080), usually quarterly, and as the main pack for the annual
  management review (DOC-ISMS-085).
- Fill first: the KPI table (section 2) from the metrics workbook, then
  the decisions requested (section 9). Write the executive summary last.
- Main pitfall: a report that lists numbers without conclusions or
  requests. Top management must leave the meeting knowing what is off
  track, why, and what they are asked to decide.
- The worked figures use the fictional medium-tier setting Quillmere
  Health Systems; all of them are *Example* values and they add up.
  Replace them with your own.
- Related templates: `isms/isms-measurement-programme`,
  `compliance/management-review`, `compliance/objectives-register`,
  `compliance/risk-register`, `isms/incident-register`,
  `isms/audit-findings-register`, `isms/control-evidence-matrix`,
  `security/security-metrics-report`.
-->

## Document control

<!-- Guidance: Each issued report is a record (clause 9.1 documented information). Do not overwrite last quarter's report: issue a new version per period and keep the history. -->

| Field | Value |
|---|---|
| Document ID | [DOC-ISMS-081] |
| Version | [2027-Q3 v1.0] |
| Status | [Draft / In review / Issued] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@coo] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (clauses 9.1, 9.3.2) |
| Reporting period | [YYYY-MM-DD to YYYY-MM-DD] |
| Method reference | [DOC-ISMS-080, measurement programme version x.y] |
| Audience | [Security steering committee (DOC-ISMS-007), executive team, management review] |
| Data cut-off date | YYYY-MM-DD |
| Next scheduled review | [Next report due YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Chief information security officer | [@ciso] | [Reviewed] | YYYY-MM-DD |
| Executive sponsor | [@coo] | [Accepted for steering committee] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 2027-Q3 v0.9 *(Example)* | YYYY-MM-DD | [@isms-manager] | Draft for metric owner commentary |
| 2027-Q3 v1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | Issued after CISO review; MET-012 commentary added |
| [version] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

1. Executive summary
2. Key performance indicators
3. Information security objectives
4. Risk position
5. Security incidents
6. Audits and compliance
7. Actions and improvement
8. Changes, resources and interested parties
9. Decisions requested
10. One-page dashboard
11. Size tiers
12. Records and evidence
13. References

## 1. Executive summary

<!-- Guidance: Five to eight lines a busy executive can read in one minute. State the overall status, what improved, what is off track and the decisions needed. Do not introduce facts that are not supported later in the report. -->

**Overall ISMS status *(Example)*: Amber.** 16 of 20 KPIs are green, 3
amber and 1 red. Critical vulnerability remediation reached target for a
second quarter. Phishing click rate (MET-012) is red at 9.4% after a
harder simulation, and corrective actions closed on time (MET-018) are
amber at 85%. One Critical risk remains open (RISK-031, colocation
power redundancy) with treatment due next quarter. No severity 1
incident occurred. The first internal audit cycle is complete with 3
minor nonconformities and no major ones.

Decisions requested: approve targeted phishing training for two teams,
approve funding for the colocation power upgrade, and confirm the date
of the management review (section 9).

## 2. Key performance indicators

<!-- Guidance: Use the metric IDs, formulas and targets from DOC-ISMS-080 without change. Show at least four periods so a trend is visible. Every amber and red value needs a commentary from its owner. Pitfall: changing a target in the report to make a value green; targets change only through the measurement programme. -->

Status: G green (at or better than target), A amber (within
tolerance), R red. Trend compares the current quarter with the previous
one: up means better, down means worse, flat means no material change.

| ID | KPI | Target | 2026-Q4 | 2027-Q1 | 2027-Q2 | 2027-Q3 | Status | Trend |
|---|---|---|---|---|---|---|---|---|
| MET-001 *(Example)* | Leaver access removed within 1 working day | 98% | 93.8% | 96.2% | 98.4% | 98.6% | G | flat |
| MET-002 *(Example)* | Quarterly access reviews on time | 100% | 80% | 90% | 100% | 100% | G | flat |
| MET-003 *(Example)* | Privileged accounts with phishing-resistant MFA | 100% | 88% | 96% | 100% | 100% | G | flat |
| MET-004 *(Example)* | Endpoints compliant with baseline | 97% | 91.0% | 94.5% | 96.1% | 97.3% | G | up |
| MET-005 *(Example)* | Critical vulnerabilities remediated within SLA | 95% | 82.0% | 91.7% | 95.3% | 96.0% | G | flat |
| MET-006 *(Example)* | Mean days to remediate high and critical | 14 days | 23 | 18 | 13 | 12 | G | up |
| MET-008 *(Example)* | Backup jobs successful | 99% | 99.2% | 99.5% | 99.4% | 99.6% | G | flat |
| MET-009 *(Example)* | Restore tests meeting RTO | 100% | 75% | 100% | 100% | 100% | G | flat |
| MET-011 *(Example)* | Awareness training completion | 95% | 88% | 93% | 96% | 97% | G | flat |
| MET-012 *(Example)* | Phishing simulation click rate | 5% or lower | 11.2% | 7.5% | 4.8% | 9.4% | R | down |
| MET-013 *(Example)* | Phishing simulation report rate | 60% or higher | 31% | 44% | 58% | 61% | G | up |
| MET-015 *(Example)* | Severity 1 incidents | 0 | 0 | 1 | 0 | 0 | G | flat |
| MET-016 *(Example)* | Mean hours to contain severity 1 and 2 | 8 hours | 14.0 | 9.5 | 7.0 | 6.5 | G | flat |
| MET-017 *(Example)* | Internal audits delivered as planned | 100% | not started | 100% | 100% | 100% | G | flat |
| MET-018 *(Example)* | Corrective actions closed by due date | 90% | 70% | 82% | 91% | 85% | A | down |
| MET-019 *(Example)* | Policies reviewed in date | 95% | 72% | 90% | 96% | 96% | G | flat |
| MET-020 *(Example)* | Risk treatment actions on schedule | 85% | 65% | 74% | 81% | 82% | A | flat |
| MET-021 *(Example)* | Risks outside appetite without approved treatment | 0 | 4 | 2 | 0 | 0 | G | flat |
| MET-022 *(Example)* | Objectives on track | 80% | 50% | 67% | 67% | 83% | G | up |
| MET-023 *(Example)* | Critical suppliers with current security review | 100% | 64% | 82% | 91% | 95% | A | up |
| [MET-NNN] | [KPI] | [target] | [value] | [value] | [value] | [value] | [G/A/R] | [trend] |

Status count for 2027-Q3 *(Example)*: 16 green, 3 amber (MET-018,
MET-020, MET-023), 1 red (MET-012), total 20.

### 2.1 Commentary on amber and red KPIs

| ID | Owner | Cause | Recovery action | Expected recovery |
|---|---|---|---|---|
| MET-012 *(Example)* | [@awareness-lead] | Simulation difficulty raised from level 2 to level 3 (spoofed internal supplier invoice); 30 of 320 recipients clicked (9.4%); two teams accounted for 19 clicks | Targeted 30-minute session for the two teams, repeat simulation at the same difficulty | 2027-Q4 |
| MET-018 *(Example)* | [@isms-manager] | 20 actions from all sources in section 7 fell due, 17 closed on time; the 3 late actions (overdue at end, section 7) depend on the colocation provider | Escalated to supplier management; due dates re-baselined with approval | 2027-Q4 |
| MET-020 *(Example)* | [@isms-manager] | 41 of 50 open treatment actions on schedule (82%); delays in network segmentation work | Additional contractor capacity requested (section 9) | 2028-Q1 |
| MET-023 *(Example)* | [@procurement-lead] | 21 of 22 critical suppliers reviewed (95%); one review awaiting the supplier's assurance report | Review scheduled once the report arrives | 2027-Q4 |

## 3. Information security objectives

<!-- Guidance: Report every objective from the objectives register (DOC-ISMS-024) with its measure and status. Under clause 6.2 progress on objectives is tracked during the year, and at the clause 9.3 review management wants to see how close each one is to its target. -->

| Objective | Measure | Target and date | Current | Status | Comment |
|---|---|---|---|---|---|
| OBJ-01 *(Example)* Achieve ISO/IEC 27001 certification for the managed scheduling service | Stage 2 completed with no open major nonconformity | By 2027-10-31 | Stage 1 done, Stage 2 booked | G | Readiness pack issued (DOC-ISMS-091) |
| OBJ-02 *(Example)* Keep critical vulnerability exposure within appetite | MET-005 | 95% each quarter from 2027-Q2 | 96.0% | G | Second quarter on target |
| OBJ-03 *(Example)* Reduce phishing susceptibility | MET-012 and MET-013 | Click 5% or lower and report 60% or higher by 2027-Q4 | 9.4% and 61% | A | Click rate red after harder simulation |
| OBJ-04 *(Example)* Timely access removal | MET-001 | 98% monthly by 2027-Q2 | 98.6% | G | Sustained |
| OBJ-05 *(Example)* Restore critical services within RTO | MET-009 | 100% of quarterly tests | 100% | G | Colocation test passed |
| OBJ-06 *(Example)* Prepare ISO/IEC 27701:2025 certification (privacy, planned for next year) | Gap assessment completed | By 2027-12-31 | Planning started | G | On plan for next year |
| [OBJ-NN] | [measure] | [target] | [value] | [G/A/R] | [comment] |

Objectives on track *(Example)*: 5 of 6 green, which is 83% and matches
MET-022.

## 4. Risk position

<!-- Guidance: Summarise the risk register (DOC-ISMS-016) by band and show movement since the last report. Highlight risks above appetite and any risk acceptance that expires before the next report. Use the 5 x 5 scale and bands in DOC-ISMS-010. -->

Bands (DOC-ISMS-010): Low 1 to 4, Medium 5 to 9, High 10 to 16,
Critical 17 to 25 (in practice 20 and 25).

| Band | Previous report | New | Moved in | Moved out | Closed | This report |
|---|---|---|---|---|---|---|
| Critical *(Example)* | 2 | 0 | 0 | 1 | 0 | 1 |
| High *(Example)* | 9 | 1 | 1 | 3 | 1 | 7 |
| Medium *(Example)* | 20 | 2 | 3 | 2 | 1 | 22 |
| Low *(Example)* | 17 | 0 | 2 | 0 | 1 | 18 |
| **Total** | **48** | **3** | **6** | **6** | **3** | **48** |

How the movements add up *(Example)*: for each band, previous + new +
moved in - moved out - closed = this report (for High: 9 + 1 + 1 - 3 -
1 = 7). Moves are re-scorings after treatment: one Critical risk fell to
High, three High risks fell to Medium and two Medium risks fell to Low,
so moves in and moves out both total 6. Three new risks entered and
three were closed, so the total stays at 48.

```mermaid
pie title Risks by band, 2027-Q3 (Example)
  "Critical" : 1
  "High" : 7
  "Medium" : 22
  "Low" : 18
```

### 4.1 Top risks

| Risk ID | Risk | Score (L x I) | Band | Owner | Treatment status |
|---|---|---|---|---|---|
| RISK-031 *(Example)* | Single power feed in the colocation suite stops the managed service | 4 x 5 = 20 | Critical | [@coo] | Upgrade quoted; funding requested (section 9) |
| RISK-011 *(Example)* | Cloud misconfiguration exposes hospital scheduling data | 3 x 5 = 15 | High | [@cloud-lead] | Configuration baseline at 97%, posture tool live |
| RISK-002 *(Example)* | Credential phishing leads to account takeover | 3 x 4 = 12 | High | [@ciso] | MFA complete, awareness action under MET-012 |
| RISK-019 *(Example)* | Key supplier unable to support recovery | 3 x 4 = 12 | High | [@procurement-lead] | Contract addendum in negotiation |
| [RISK-NNN] | [risk] | [L x I] | [band] | [@owner] | [status] |

### 4.2 Risk acceptances

| Acceptance ID | Risk | Band | Accepted by | Expires | Action |
|---|---|---|---|---|---|
| ACC-007 *(Example)* | RISK-024 legacy reporting server without vendor support | High | [@ceo] | YYYY-MM-DD | Decommission planned; renew or close at next steering committee |
| [ACC-NNN] | [RISK-NNN] | [band] | [@approver] | YYYY-MM-DD | [action] |

Record new acceptances in the risk acceptance record
(`isms/isms-risk-acceptance-record`, DOC-ISMS-019).

## 5. Security incidents

<!-- Guidance: Summarise the incident register (DOC-ISMS-021) by severity and category, with lessons learned. Report personal data breaches and notifications to authorities or customers separately, because they carry legal deadlines. -->

| Severity | 2027-Q2 | 2027-Q3 | Notes |
|---|---|---|---|
| 1 Critical *(Example)* | 0 | 0 | None |
| 2 High *(Example)* | 1 | 2 | One business e-mail compromise attempt contained in 5 hours; one malware infection on a contractor laptop contained in 8 hours |
| 3 Medium *(Example)* | 9 | 11 | Mostly misdirected e-mails and lost devices (encrypted) |
| 4 Low *(Example)* | 30 | 34 | Blocked phishing and policy reminders |
| **Total** | **40** | **47** | |

Mean time to contain severity 1 and 2 in 2027-Q3 *(Example)*: (5 + 8) /
2 = 6.5 hours, as reported in MET-016.

| Item | This period *(Example)* |
|---|---|
| Personal data breaches assessed | 3 (all severity 3 misdirected e-mails) |
| Notified to supervisory authority | 0 (as processor, notifying the authority is the customer's decision; no breach of own controller data was likely to result in a risk, assessment documented) |
| Notified to customers as processor | 1 (hospital informed within the contractual 48 hours) |
| Post-incident reviews completed | 2 of 2 severity 2 incidents (DOC-ISMS-022) |
| Lessons learned turned into actions | 4 actions raised, 2 closed |

## 6. Audits and compliance

<!-- Guidance: Report internal audits (DOC-ISMS-082, DOC-ISMS-084), external audits, customer audits and independent reviews. Give the count of findings by grade and the status of their actions. Pitfall: reporting findings without saying whether the corrective actions work. -->

| Audit | Date | Scope | Major NC | Minor NC | Observations and opportunities | Status |
|---|---|---|---|---|---|---|
| Internal audit IA-2027-03 *(Example)* | YYYY-MM-DD | Clauses 7 and 8, A.5.19 to A.5.23 | 0 | 2 | 3 | Actions open, due 2027-Q4 |
| Internal audit IA-2027-04 *(Example)* | YYYY-MM-DD | A.8 technological controls sample | 0 | 1 | 3 | Actions open |
| Certification Stage 1 *(Example)* | YYYY-MM-DD | Full ISMS documentation and readiness | not graded | not graded | 5 areas of concern | 4 resolved, 1 in progress |
| Customer audit (hospital group) *(Example)* | YYYY-MM-DD | Service security schedule | 0 | 0 | 2 | Closed |
| **Total internal NCs this period** | | | **0** | **3** | **6** | |

Compliance status *(Example)*: no new legal or regulatory requirement
entered the legal register (DOC-ISMS-014) this period; one customer
contract added a 24-hour incident notice, now reflected in the incident
response plan (DOC-ISMS-020).

## 7. Actions and improvement

<!-- Guidance: Report corrective actions (DOC-ISMS-087), audit findings (DOC-ISMS-086) and improvement items (DOC-ISMS-088). Show ageing so long-overdue items are visible. -->

| Action source | Open at start | Raised | Closed | Open at end | Overdue at end |
|---|---|---|---|---|---|
| Corrective actions (nonconformities) *(Example)* | 9 | 6 | 8 | 7 | 2 |
| Audit observations and opportunities *(Example)* | 5 | 6 | 4 | 7 | 0 |
| Incident lessons learned *(Example)* | 3 | 4 | 2 | 5 | 1 |
| Improvement register items *(Example)* | 12 | 5 | 6 | 11 | 0 |
| **Total** | **29** | **21** | **20** | **30** | **3** |

Check: open at end = open at start + raised - closed (29 + 21 - 20 =
30). Overdue items: [list IDs and owners].

## 8. Changes, resources and interested parties

<!-- Guidance: The clause 9.3.2 review looks outward as well as inward: what has shifted in the business and its environment, what customers, regulators and other stakeholders now want, and what they have told you. Resources are not a listed 9.3 input in ISO/IEC 27001 (clause 7.1 covers them) but are worth reporting here as good practice. Summarise them so the review has the inputs in one place. -->

| Topic | This period *(Example)* | Effect on the ISMS |
|---|---|---|
| Internal issues | New patient messaging feature planned for 2028 | Risk assessment and DPIA required before design freeze |
| External issues | Rise in invoice fraud targeting healthcare suppliers | Phishing simulation theme updated; RISK-002 reassessed |
| Interested parties | Two hospital customers asked for evidence of 27001 progress | Trust page update and certification timeline shared |
| Climate-related issues (clause 4.1, Amd 1:2024) | Heat event affected colocation cooling for 2 hours | Recorded in context review DOC-ISMS-003; linked to RISK-031 |
| Resources | Security team of 3 at capacity during audit preparation | Contractor support requested (section 9) |
| Planned changes to the ISMS | Scope to add the second office's support desk | Change plan DOC-ISMS-025 item raised |

## 9. Decisions requested

<!-- Guidance: List each decision with options, cost and the consequence of not deciding. Minutes of the steering committee or management review must record the outcome; that record is the evidence that top management evaluated the results. -->

| Decision ID | Request | Options | Cost *(Example, USD)* | Recommended | Consequence if deferred |
|---|---|---|---|---|---|
| DEC-2027-Q3-01 *(Example)* | Fund colocation power redundancy | A: second feed and UPS upgrade; B: move to provider's resilient hall | A 48,000; B 62,000 per year | A | RISK-031 stays Critical beyond the Stage 2 audit |
| DEC-2027-Q3-02 *(Example)* | Targeted phishing training for two teams | A: live session; B: e-learning only | A 3,500; B 0 | A | MET-012 likely to stay red |
| DEC-2027-Q3-03 *(Example)* | Contractor support for segmentation work | 0.5 FTE for 6 months | 39,000 | Approve | MET-020 stays amber; RISK-011 treatment slips |
| DEC-2027-Q3-04 *(Example)* | Confirm management review date | YYYY-MM-DD | none | Confirm | Review falls after Stage 2 |

Total funding requested *(Example)*: 48,000 + 3,500 + 39,000 = 90,500
USD. Use your local currency.

## 10. One-page dashboard

<!-- Guidance: The dashboard is the first page of the issued report or a slide. Keep it to one page: status, six to eight headline KPIs, risk band counts, incidents, audit findings, top three decisions. Use the same figures as the detailed sections. -->

The layout below fits one printed page or one slide. Every figure on it
comes from sections 2 to 9; update the dashboard last, after the
detailed sections are final.

```text
+------------------------------------------------------------------+
| ISMS PERFORMANCE  2027-Q3   Quillmere Health Systems (Example)   |
| Overall status: AMBER    KPIs: 16 G / 3 A / 1 R (20)             |
+-------------------------------+----------------------------------+
| HEADLINE KPIs        Q3  Trend| RISK POSITION   prev -> now      |
| Leaver access      98.6%  =   | Critical          2 -> 1         |
| Critical vulns SLA 96.0%  =   | High              9 -> 7         |
| Endpoint baseline  97.3%  ^   | Medium           20 -> 22        |
| Phishing click      9.4%  v R | Low              17 -> 18        |
| Phishing report      61%  ^   | Total            48 -> 48        |
| CAPA on time         85%  v A |                                  |
+-------------------------------+----------------------------------+
| INCIDENTS  S1 0  S2 2  S3 11  S4 34  (total 47)                  |
| AUDITS     Internal: 0 major, 3 minor, 6 obs.  Stage 1 done      |
| OBJECTIVES 5 of 6 on track (83%)                                 |
+------------------------------------------------------------------+
| DECISIONS: 1 Colocation power (48k)  2 Phishing training (3.5k)  |
|            3 Segmentation contractor (39k)  4 Review date        |
+------------------------------------------------------------------+
```

## 11. Size tiers

<!-- Guidance: The depth and rhythm of the report change with size. Keep the structure; scale the detail. The settings are the library's fictional examples. -->

| Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Profile | 46 staff, SaaS on one public cloud in two regions, part-time ISMS manager (0.5 FTE) | 320 staff, two offices, one colocation suite, ISMS manager plus 3-person security team | 2,400 staff, 6 sites in 4 countries, CISO with a 14-person security office, integrated management system |
| Frequency | Quarterly, as a standing item in the leadership meeting | Quarterly to the security steering committee, annual pack for management review | Monthly site dashboards, quarterly group report, annual integrated management review with ISO 9001 and ISO 22301 |
| Length | Two to three pages: dashboard plus sections 2, 4 and 9 | Full report as in this template | Group summary plus one appendix per site and one for OT |
| KPIs | 10 to 12 | 20 | 30 to 40 group KPIs with site comparison |
| Audience | Chief executive, chief technology officer, head of customer success | Executive team and steering committee | Group executive board, site managing directors, audit committee |
| Specific content | Customer security questionnaire volume and outcomes | Hospital customer commitments, colocation status | Site-by-site certification phasing progress, OT exposure, integrated audit results |

## 12. Records and evidence

<!-- Guidance: The issued report and the decisions taken on it are the evidence for clauses 9.1 and 9.3. Keep them together and retrievable for the certification body. -->

| Record | Proves | Kept by | Location | Retention *(Example)* |
|---|---|---|---|---|
| Issued performance report per period | Results of monitoring and measurement (9.1) | ISMS manager | Document management system, ISMS reports folder | 3 years (one certification cycle) |
| Metrics workbook snapshot at the cut-off date | Figures in the report are traceable | ISMS manager | Metrics folder, read-only | 3 years |
| Owner commentary on amber and red KPIs | Analysis of results | Metric owners | Workbook or report section 2.1 | 3 years |
| Steering committee minutes with decisions | Evaluation by management | Committee secretary | Minutes repository | 3 years |
| Management review minutes (DOC-ISMS-085) | Review inputs considered and outputs decided (9.3) | ISMS manager | Document management system | 3 years or as set in DOC-ISMS-028 |
| Distribution record | Report reached its audience | ISMS manager | E-mail or portal log | 1 year |

Link these records in the control evidence matrix
(`isms/control-evidence-matrix`, DOC-ISMS-033) under clauses 9.1 and
9.3.

## 13. References

<!-- Guidance: Cite only the editions you used. The report method itself is defined in DOC-ISMS-080. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html ; https://www.iso.org/standard/88435.html | Clauses 6.2, 9.1, 9.3 and the climate change issue in 4.1 |
| ISO/IEC 27004:2016 | https://www.iso.org/standard/64120.html | Measurement and reporting guidance; a revision is in progress |
| ISO/IEC 27002:2022 | https://www.iso.org/standard/75652.html | Control context for KPI interpretation |

Related templates: `isms/isms-measurement-programme` (DOC-ISMS-080),
`compliance/management-review` (DOC-ISMS-085),
`compliance/objectives-register` (DOC-ISMS-024),
`compliance/risk-register` (DOC-ISMS-016),
`isms/isms-risk-acceptance-record` (DOC-ISMS-019),
`isms/incident-register` (DOC-ISMS-021),
`isms/audit-findings-register` (DOC-ISMS-086),
`isms/isms-steering-committee-charter` (DOC-ISMS-007),
`security/security-metrics-report`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.1 and
9.3, with reporting ideas informed by ISO/IEC 27004:2016. The text,
dashboard layout, KPIs and all figures are original and illustrative;
no ISO or IEC text, tables or definitions are reproduced, and you need
the official standards to apply the requirements. ISO and IEC standards
are copyrighted and sold by ISO, IEC and national standards bodies.
Check the current edition and amendments before use. Template licence:
MIT.