ISMS Metrics, Management Review & Evidence Tracker (Excel) — 25 measures, the 9.3 review template and an evidence register for all 93 controls

A quality system is audited on records the work produces by itself. An ISMS is audited on evidence somebody has to go and collect. An access review, a restore test, a log review, a supplier check — if nobody owns the collection and no date says when, it does not happen, and "Implemented" on the Statement of Applicability becomes a nonconformity at Stage 2. Add the two other post-certification findings auditors report most — no metrics (clause 9.1) and a management review that was late, thin or run by the ISMS manager for the ISMS manager (9.3) — and you have the reason this workbook exists.

Twenty-five measures, written in. Phishing click and report rates, awareness completion, leaver access removed within 24 hours, MFA on privileged accounts, access reviews on schedule, dormant accounts, patch latency, endpoint protection and encryption, backup success and restore tests, events reported, time to classify and contain, post-incident reviews, overdue corrective and treatment actions, supplier reviews, audits against the programme, evidence overdue, high findings left open. Each one names what it tells you, the clause or control it evidences, how it is measured, the source, a target, the direction, and an amber band. Keep eight to twelve, switch the rest off, add your own.

Type the numbers; the status answers itself. Twelve month columns from a start date you set. Latest and Previous pick up the last two entries (quarterly measures with gaps between them work), Trend reads them against the measure's direction, and Status is Green when the target is met, Amber inside the band, Red beyond it. The dashboard shows every measure with quarter averages, the RAG counts, the evidence register status, days since the last management review and the health score — the first page of the review pack.

An evidence register for every control. Fifteen clause-level records and all 93 Annex A controls, each with the evidence that shows it works, applicability (mark the controls your SoA excludes), an owner, a collection frequency, where the evidence lives, when it was last collected, a calculated next-due date and a live OK / Due soon / Overdue / Not yet collected status.

Management review, agenda and minutes in one. Every input clause 9.3.2 expects as a row — in plain English, with where the data for each comes from — plus the results section, the previous review's actions carried in, and the sign-off. Fill one copy per review and keep it.

A ten-point health check on the measurement system itself, scored, and a guidance sheet on choosing measures, setting targets you mean, the evidence rhythm, running the review and what the auditor will ask.

Built by working management-system auditors for a 50-to-500-person organisation without a compliance platform. No macros, no add-ins.

What's inside — eleven sheets

• KPI register — 25 measures with what each shows, clause or control, method, unit, source, owner, frequency, target, direction and amber band; 15 blank rows for your own.
• Monthly data — twelve months per measure from an editable start month; Latest, Previous, Trend and Green / Amber / Red status calculated.
• Dashboard — RAG counts, every measure with quarter averages, evidence status, review cadence, health score; a reporting-date cell for printing the pack as at the review date.
• Evidence register — 15 clause records + 93 controls: evidence that shows it works, applicability, owner, frequency, location, last collected, next due (calculated), status (live).
• Management review — the 9.3.2 inputs one row each with their data sources; evidence presented, discussion, decision, owner, due; results; previous actions; sign-off.
• Health check — ten tests scored out of ten.
• Guidance — why measure, choosing measures, targets and the amber band, the evidence rhythm, running the review, what the auditor asks, clause map.
• Three worked-example sheets — Veldline Logistics (Pty) Ltd, the fictional 120-person logistics firm from the Risk Assessment & SoA Toolkit, nine months into its ISMS: live monthly data, an evidence register with the realistic mix of statuses, and the complete minutes of its July 2027 review with every input answered.

Who it's for

ISMS leads, quality and compliance managers and IT managers running an ISO/IEC 27001:2022 system between audits — and anyone preparing the first management review who wants to walk in with a dashboard rather than a slide.

Why buy it

• See exactly what's inside before you buy — the sheets are previewed above.
• Instant download, secure checkout (Visa, Mastercard, PayPal).
• Single-organisation licence — use it across your whole organisation, no per-user fees.
• Plain Excel (2016 or later, or LibreOffice) — nothing to install, no macros.

Pairs with: the Risk Assessment & SoA Toolkit — the register, treatment plan and Statement of Applicability this tracker refers to, on the same worked example. Start free: the ISO 27001:2022 Gap Analysis Checklist and the free ISO 27001 masterclass.

This workbook supports the ISO/IEC 27001:2022 monitoring, measurement, management-review and documented-information requirements (clauses 9.1, 9.3, 7.5) and the Annex A evidence an auditor samples, in Qlause's own format; it reproduces no ISO text. Work from your licensed copies of ISO/IEC 27001:2022 and 27002:2022. The measures, frequencies and the worked example are starting points, not requirements. Qlause is an independent templates and training provider, not a certification body. Not legal or security advice.