ISMS Performance Report Template (ISO/IEC 27001 9.1, 9.3)
Periodic ISMS report to management: KPI table with trend, objectives, risk by band, incidents, audits, actions, decisions, one-page dashboard
使用方法: Use it each reporting period and as the main pack for the management review. Fill the KPI table from the measurement programme and the decisions requested first, the executive summary last. The main pitfall is listing numbers without conclusions or decisions for top management.
预览
ISMS Performance Report: [Organization name], [Period]
Periodic report to top management on the performance and effectiveness of the information security management system (ISMS) of [Organization name]. It presents the results of monitoring and measurement required by ISO/IEC 27001:2022 + Amd 1:2024 clause 9.1 and supplies inputs to the management review in clause 9.3: KPI trends, objectives status, risks, incidents, audit results and actions, with a one-page dashboard. Replace every
[bracketed]value and every row marked Example.
Document control
| Field | Value |
|---|---|
| Document ID | [DOC-ISMS-081] |
| Version | [2027-Q3 v1.0] |
| Status | [Draft / In review / Issued] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@coo] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (clauses 9.1, 9.3.2) |
| Reporting period | [YYYY-MM-DD to YYYY-MM-DD] |
| Method reference | [DOC-ISMS-080, measurement programme version x.y] |
| Audience | [Security steering committee (DOC-ISMS-007), executive team, management review] |
| Data cut-off date | YYYY-MM-DD |
| Next scheduled review | [Next report due YYYY-MM-DD] |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Chief information security officer | [@ciso] | [Reviewed] | YYYY-MM-DD |
| Executive sponsor | [@coo] | [Accepted for steering committee] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 2027-Q3 v0.9 (Example) | YYYY-MM-DD | [@isms-manager] | Draft for metric owner commentary |
| 2027-Q3 v1.0 (Example) | YYYY-MM-DD | [@isms-manager] | Issued after CISO review; MET-012 commentary added |
| [version] | YYYY-MM-DD | [@author] | [Change summary] |
Contents
- Executive summary
- Key performance indicators
- Information security objectives
- Risk position
- Security incidents
- Audits and compliance
- Actions and improvement
- Changes, resources and interested parties
- Decisions requested
- One-page dashboard
- Size tiers
- Records and evidence
- References
1. Executive summary
Overall ISMS status (Example): Amber. 16 of 20 KPIs are green, 3 amber and 1 red. Critical vulnerability remediation reached target for a second quarter. Phishing click rate (MET-012) is red at 9.4% after a harder simulation, and corrective actions closed on time (MET-018) are amber at 85%. One Critical risk remains open (RISK-031, colocation power redundancy) with treatment due next quarter. No severity 1 incident occurred. The first internal audit cycle is complete with 3 minor nonconformities and no major ones.
Decisions requested: approve targeted phishing training for two teams, approve funding for the colocation power upgrade, and confirm the date of the management review (section 9).
2. Key performance indicators
Status: G green (at or better than target), A amber (within tolerance), R red. Trend compares the current quarter with the previous one: up means better, down means worse, flat means no material change.
| ID | KPI | Target | 2026-Q4 | 2027-Q1 | 2027-Q2 | 2027-Q3 | Status | Trend |
|---|---|---|---|---|---|---|---|---|
| MET-001 (Example) | Leaver access removed within 1 working day | 98% | 93.8% | 96.2% | 98.4% | 98.6% | G | flat |
| MET-002 (Example) | Quarterly access reviews on time | 100% | 80% | 90% | 100% | 100% | G | flat |
| MET-003 (Example) | Privileged accounts with phishing-resistant MFA | 100% | 88% | 96% | 100% | 100% | G | flat |
| MET-004 (Example) | Endpoints compliant with baseline | 97% | 91.0% | 94.5% | 96.1% | 97.3% | G | up |
| MET-005 (Example) | Critical vulnerabilities remediated within SLA | 95% | 82.0% | 91.7% | 95.3% | 96.0% | G | flat |
| MET-006 (Example) | Mean days to remediate high and critical | 14 days | 23 | 18 | 13 | 12 | G | up |
| MET-008 (Example) | Backup jobs successful | 99% | 99.2% | 99.5% | 99.4% | 99.6% | G | flat |
| MET-009 (Example) | Restore tests meeting RTO | 100% | 75% | 100% | 100% | 100% | G | flat |
| MET-011 (Example) | Awareness training completion | 95% | 88% | 93% | 96% | 97% | G | flat |
| MET-012 (Example) | Phishing simulation click rate | 5% or lower | 11.2% | 7.5% | 4.8% | 9.4% | R | down |
| MET-013 (Example) | Phishing simulation report rate | 60% or higher | 31% | 44% | 58% | 61% | G | up |
| MET-015 (Example) | Severity 1 incidents | 0 | 0 | 1 | 0 | 0 | G | flat |
| MET-016 (Example) | Mean hours to contain severity 1 and 2 | 8 hours | 14.0 | 9.5 | 7.0 | 6.5 | G | flat |
| MET-017 (Example) | Internal audits delivered as planned | 100% | not started | 100% | 100% | 100% | G | flat |
| MET-018 (Example) | Corrective actions closed by due date | 90% | 70% | 82% | 91% | 85% | A | down |
| MET-019 (Example) | Policies reviewed in date | 95% | 72% | 90% | 96% | 96% | G | flat |
| MET-020 (Example) | Risk treatment actions on schedule | 85% | 65% | 74% | 81% | 82% | A | flat |
| MET-021 (Example) | Risks outside appetite without approved treatment | 0 | 4 | 2 | 0 | 0 | G | flat |
| MET-022 (Example) | Objectives on track | 80% | 50% | 67% | 67% | 83% | G | up |
| MET-023 (Example) | Critical suppliers with current security review | 100% | 64% | 82% | 91% | 95% | A | up |
| [MET-NNN] | [KPI] | [target] | [value] | [value] | [value] | [value] | [G/A/R] | [trend] |
Status count for 2027-Q3 (Example): 16 green, 3 amber (MET-018, MET-020, MET-023), 1 red (MET-012), total 20.
2.1 Commentary on amber and red KPIs
| ID | Owner | Cause | Recovery action | Expected recovery |
|---|---|---|---|---|
| MET-012 (Example) | [@awareness-lead] | Simulation difficulty raised from level 2 to level 3 (spoofed internal supplier invoice); 30 of 320 recipients clicked (9.4%); two teams accounted for 19 clicks | Targeted 30-minute session for the two teams, repeat simulation at the same difficulty | 2027-Q4 |
| MET-018 (Example) | [@isms-manager] | 20 actions from all sources in section 7 fell due, 17 closed on time; the 3 late actions (overdue at end, section 7) depend on the colocation provider | Escalated to supplier management; due dates re-baselined with approval | 2027-Q4 |
| MET-020 (Example) | [@isms-manager] | 41 of 50 open treatment actions on schedule (82%); delays in network segmentation work | Additional contractor capacity requested (section 9) | 2028-Q1 |
| MET-023 (Example) | [@procurement-lead] | 21 of 22 critical suppliers reviewed (95%); one review awaiting the supplier's assurance report | Review scheduled once the report arrives | 2027-Q4 |
3. Information security objectives
| Objective | Measure | Target and date | Current | Status | Comment |
|---|---|---|---|---|---|
| OBJ-01 (Example) Achieve ISO/IEC 27001 certification for the managed scheduling service | Stage 2 completed with no open major nonconformity | By 2027-10-31 | Stage 1 done, Stage 2 booked | G | Readiness pack issued (DOC-ISMS-091) |
| OBJ-02 (Example) Keep critical vulnerability exposure within appetite | MET-005 | 95% each quarter from 2027-Q2 | 96.0% | G | Second quarter on target |
| OBJ-03 (Example) Reduce phishing susceptibility | MET-012 and MET-013 | Click 5% or lower and report 60% or higher by 2027-Q4 | 9.4% and 61% | A | Click rate red after harder simulation |
| OBJ-04 (Example) Timely access removal | MET-001 | 98% monthly by 2027-Q2 | 98.6% | G | Sustained |
| OBJ-05 (Example) Restore critical services within RTO | MET-009 | 100% of quarterly tests | 100% | G | Colocation test passed |
| OBJ-06 (Example) Prepare ISO/IEC 27701:2025 certification (privacy, planned for next year) | Gap assessment completed | By 2027-12-31 | Planning started | G | On plan for next year |
| [OBJ-NN] | [measure] | [target] | [value] | [G/A/R] | [comment] |
Objectives on track (Example): 5 of 6 green, which is 83% and matches MET-022.
4. Risk position
Bands (DOC-ISMS-010): Low 1 to 4, Medium 5 to 9, High 10 to 16, Critical 17 to 25 (in practice 20 and 25).
| Band | Previous report | New | Moved in | Moved out | Closed | This report |
|---|---|---|---|---|---|---|
| Critical (Example) | 2 | 0 | 0 | 1 | 0 | 1 |
| High (Example) | 9 | 1 | 1 | 3 | 1 | 7 |
| Medium (Example) | 20 | 2 | 3 | 2 | 1 | 22 |
| Low (Example) | 17 | 0 | 2 | 0 | 1 | 18 |
| Total | 48 | 3 | 6 | 6 | 3 | 48 |
How the movements add up (Example): for each band, previous + new + moved in - moved out - closed = this report (for High: 9 + 1 + 1 - 3 - 1 = 7). Moves are re-scorings after treatment: one Critical risk fell to High, three High risks fell to Medium and two Medium risks fell to Low, so moves in and moves out both total 6. Three new risks entered and three were closed, so the total stays at 48.
4.1 Top risks
| Risk ID | Risk | Score (L x I) | Band | Owner | Treatment status |
|---|---|---|---|---|---|
| RISK-031 (Example) | Single power feed in the colocation suite stops the managed service | 4 x 5 = 20 | Critical | [@coo] | Upgrade quoted; funding requested (section 9) |
| RISK-011 (Example) | Cloud misconfiguration exposes hospital scheduling data | 3 x 5 = 15 | High | [@cloud-lead] | Configuration baseline at 97%, posture tool live |
| RISK-002 (Example) | Credential phishing leads to account takeover | 3 x 4 = 12 | High | [@ciso] | MFA complete, awareness action under MET-012 |
| RISK-019 (Example) | Key supplier unable to support recovery | 3 x 4 = 12 | High | [@procurement-lead] | Contract addendum in negotiation |
| [RISK-NNN] | [risk] | [L x I] | [band] | [@owner] | [status] |
4.2 Risk acceptances
| Acceptance ID | Risk | Band | Accepted by | Expires | Action |
|---|---|---|---|---|---|
| ACC-007 (Example) | RISK-024 legacy reporting server without vendor support | High | [@ceo] | YYYY-MM-DD | Decommission planned; renew or close at next steering committee |
| [ACC-NNN] | [RISK-NNN] | [band] | [@approver] | YYYY-MM-DD | [action] |
Record new acceptances in the risk acceptance record
(isms/isms-risk-acceptance-record, DOC-ISMS-019).
5. Security incidents
| Severity | 2027-Q2 | 2027-Q3 | Notes |
|---|---|---|---|
| 1 Critical (Example) | 0 | 0 | None |
| 2 High (Example) | 1 | 2 | One business e-mail compromise attempt contained in 5 hours; one malware infection on a contractor laptop contained in 8 hours |
| 3 Medium (Example) | 9 | 11 | Mostly misdirected e-mails and lost devices (encrypted) |
| 4 Low (Example) | 30 | 34 | Blocked phishing and policy reminders |
| Total | 40 | 47 |
Mean time to contain severity 1 and 2 in 2027-Q3 (Example): (5 + 8) / 2 = 6.5 hours, as reported in MET-016.
| Item | This period (Example) |
|---|---|
| Personal data breaches assessed | 3 (all severity 3 misdirected e-mails) |
| Notified to supervisory authority | 0 (as processor, notifying the authority is the customer's decision; no breach of own controller data was likely to result in a risk, assessment documented) |
| Notified to customers as processor | 1 (hospital informed within the contractual 48 hours) |
| Post-incident reviews completed | 2 of 2 severity 2 incidents (DOC-ISMS-022) |
| Lessons learned turned into actions | 4 actions raised, 2 closed |
6. Audits and compliance
| Audit | Date | Scope | Major NC | Minor NC | Observations and opportunities | Status |
|---|---|---|---|---|---|---|
| Internal audit IA-2027-03 (Example) | YYYY-MM-DD | Clauses 7 and 8, A.5.19 to A.5.23 | 0 | 2 | 3 | Actions open, due 2027-Q4 |
| Internal audit IA-2027-04 (Example) | YYYY-MM-DD | A.8 technological controls sample | 0 | 1 | 3 | Actions open |
| Certification Stage 1 (Example) | YYYY-MM-DD | Full ISMS documentation and readiness | not graded | not graded | 5 areas of concern | 4 resolved, 1 in progress |
| Customer audit (hospital group) (Example) | YYYY-MM-DD | Service security schedule | 0 | 0 | 2 | Closed |
| Total internal NCs this period | 0 | 3 | 6 |
Compliance status (Example): no new legal or regulatory requirement entered the legal register (DOC-ISMS-014) this period; one customer contract added a 24-hour incident notice, now reflected in the incident response plan (DOC-ISMS-020).
7. Actions and improvement
| Action source | Open at start | Raised | Closed | Open at end | Overdue at end |
|---|---|---|---|---|---|
| Corrective actions (nonconformities) (Example) | 9 | 6 | 8 | 7 | 2 |
| Audit observations and opportunities (Example) | 5 | 6 | 4 | 7 | 0 |
| Incident lessons learned (Example) | 3 | 4 | 2 | 5 | 1 |
| Improvement register items (Example) | 12 | 5 | 6 | 11 | 0 |
| Total | 29 | 21 | 20 | 30 | 3 |
Check: open at end = open at start + raised - closed (29 + 21 - 20 = 30). Overdue items: [list IDs and owners].
8. Changes, resources and interested parties
| Topic | This period (Example) | Effect on the ISMS |
|---|---|---|
| Internal issues | New patient messaging feature planned for 2028 | Risk assessment and DPIA required before design freeze |
| External issues | Rise in invoice fraud targeting healthcare suppliers | Phishing simulation theme updated; RISK-002 reassessed |
| Interested parties | Two hospital customers asked for evidence of 27001 progress | Trust page update and certification timeline shared |
| Climate-related issues (clause 4.1, Amd 1:2024) | Heat event affected colocation cooling for 2 hours | Recorded in context review DOC-ISMS-003; linked to RISK-031 |
| Resources | Security team of 3 at capacity during audit preparation | Contractor support requested (section 9) |
| Planned changes to the ISMS | Scope to add the second office's support desk | Change plan DOC-ISMS-025 item raised |
9. Decisions requested
| Decision ID | Request | Options | Cost (Example, USD) | Recommended | Consequence if deferred |
|---|---|---|---|---|---|
| DEC-2027-Q3-01 (Example) | Fund colocation power redundancy | A: second feed and UPS upgrade; B: move to provider's resilient hall | A 48,000; B 62,000 per year | A | RISK-031 stays Critical beyond the Stage 2 audit |
| DEC-2027-Q3-02 (Example) | Targeted phishing training for two teams | A: live session; B: e-learning only | A 3,500; B 0 | A | MET-012 likely to stay red |
| DEC-2027-Q3-03 (Example) | Contractor support for segmentation work | 0.5 FTE for 6 months | 39,000 | Approve | MET-020 stays amber; RISK-011 treatment slips |
| DEC-2027-Q3-04 (Example) | Confirm management review date | YYYY-MM-DD | none | Confirm | Review falls after Stage 2 |
Total funding requested (Example): 48,000 + 3,500 + 39,000 = 90,500 USD. Use your local currency.
10. One-page dashboard
The layout below fits one printed page or one slide. Every figure on it comes from sections 2 to 9; update the dashboard last, after the detailed sections are final.
+------------------------------------------------------------------+
| ISMS PERFORMANCE 2027-Q3 Quillmere Health Systems (Example) |
| Overall status: AMBER KPIs: 16 G / 3 A / 1 R (20) |
+-------------------------------+----------------------------------+
| HEADLINE KPIs Q3 Trend| RISK POSITION prev -> now |
| Leaver access 98.6% = | Critical 2 -> 1 |
| Critical vulns SLA 96.0% = | High 9 -> 7 |
| Endpoint baseline 97.3% ^ | Medium 20 -> 22 |
| Phishing click 9.4% v R | Low 17 -> 18 |
| Phishing report 61% ^ | Total 48 -> 48 |
| CAPA on time 85% v A | |
+-------------------------------+----------------------------------+
| INCIDENTS S1 0 S2 2 S3 11 S4 34 (total 47) |
| AUDITS Internal: 0 major, 3 minor, 6 obs. Stage 1 done |
| OBJECTIVES 5 of 6 on track (83%) |
+------------------------------------------------------------------+
| DECISIONS: 1 Colocation power (48k) 2 Phishing training (3.5k) |
| 3 Segmentation contractor (39k) 4 Review date |
+------------------------------------------------------------------+
11. Size tiers
| Aspect | Small: Quillmere Analytics Ltd (Example) | Medium: Quillmere Health Systems (Example) | Large: Quillmere Group (Example) |
|---|---|---|---|
| Profile | 46 staff, SaaS on one public cloud in two regions, part-time ISMS manager (0.5 FTE) | 320 staff, two offices, one colocation suite, ISMS manager plus 3-person security team | 2,400 staff, 6 sites in 4 countries, CISO with a 14-person security office, integrated management system |
| Frequency | Quarterly, as a standing item in the leadership meeting | Quarterly to the security steering committee, annual pack for management review | Monthly site dashboards, quarterly group report, annual integrated management review with ISO 9001 and ISO 22301 |
| Length | Two to three pages: dashboard plus sections 2, 4 and 9 | Full report as in this template | Group summary plus one appendix per site and one for OT |
| KPIs | 10 to 12 | 20 | 30 to 40 group KPIs with site comparison |
| Audience | Chief executive, chief technology officer, head of customer success | Executive team and steering committee | Group executive board, site managing directors, audit committee |
| Specific content | Customer security questionnaire volume and outcomes | Hospital customer commitments, colocation status | Site-by-site certification phasing progress, OT exposure, integrated audit results |
12. Records and evidence
| Record | Proves | Kept by | Location | Retention (Example) |
|---|---|---|---|---|
| Issued performance report per period | Results of monitoring and measurement (9.1) | ISMS manager | Document management system, ISMS reports folder | 3 years (one certification cycle) |
| Metrics workbook snapshot at the cut-off date | Figures in the report are traceable | ISMS manager | Metrics folder, read-only | 3 years |
| Owner commentary on amber and red KPIs | Analysis of results | Metric owners | Workbook or report section 2.1 | 3 years |
| Steering committee minutes with decisions | Evaluation by management | Committee secretary | Minutes repository | 3 years |
| Management review minutes (DOC-ISMS-085) | Review inputs considered and outputs decided (9.3) | ISMS manager | Document management system | 3 years or as set in DOC-ISMS-028 |
| Distribution record | Report reached its audience | ISMS manager | E-mail or portal log | 1 year |
Link these records in the control evidence matrix
(isms/control-evidence-matrix, DOC-ISMS-033) under clauses 9.1 and
9.3.
13. References
| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html ; https://www.iso.org/standard/88435.html | Clauses 6.2, 9.1, 9.3 and the climate change issue in 4.1 |
| ISO/IEC 27004:2016 | https://www.iso.org/standard/64120.html | Measurement and reporting guidance; a revision is in progress |
| ISO/IEC 27002:2022 | https://www.iso.org/standard/75652.html | Control context for KPI interpretation |
Related templates: isms/isms-measurement-programme (DOC-ISMS-080),
compliance/management-review (DOC-ISMS-085),
compliance/objectives-register (DOC-ISMS-024),
compliance/risk-register (DOC-ISMS-016),
isms/isms-risk-acceptance-record (DOC-ISMS-019),
isms/incident-register (DOC-ISMS-021),
isms/audit-findings-register (DOC-ISMS-086),
isms/isms-steering-committee-charter (DOC-ISMS-007),
security/security-metrics-report.
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.1 and 9.3, with reporting ideas informed by ISO/IEC 27004:2016. The text, dashboard layout, KPIs and all figures are original and illustrative; no ISO or IEC text, tables or definitions are reproduced, and you need the official standards to apply the requirements. ISO and IEC standards are copyrighted and sold by ISO, IEC and national standards bodies. Check the current edition and amendments before use. Template licence: MIT.
相关模板
ISMS Internal Audit Report Template (ISO/IEC 27001 clause 9.2)
Report for one ISMS audit: scope, criteria, team and independence, sampling, findings with evidence and clause references, conclusions, distribution, follow-up
ISMS 与 ISO/IEC 27001Risk Assessment Report Template (ISO/IEC 27001 8.2)
One cycle: scope, method refs, participants, results by band, current and residual heat maps, top risks, changes since last cycle, treatment hand-off
ISMS 与 ISO/IEC 27001Access Control Policy Template (ISO/IEC 27001 A.5.15)
Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics