Evaluate
Evaluate looks at where the entity is heading against its objectives and decides what has to change, including which security objectives should be prioritised.
What clause 7.3.2 asks
Evaluate looks forward as well as back. It weighs how objectives are being met now and how they are likely to be met on current processes and planned changes, then decides where to adjust. The board should make sure initiatives account for relevant risks and opportunities, and should answer security measurements and reports by setting and ranking objectives for each management system, including requirements from outside its scope. Each system's leadership should show that security supports and sustains the entity's aims, and should bring major security projects up for board approval. The process is therefore not a review of the last quarter. It is a decision about the next one, and it should leave a written response behind.
Why it matters
Evaluate is the process that turns reporting into direction. A board that receives a report and files it has not evaluated anything. The clause asks for a response: the objectives specified and prioritised in the light of what was reported, and the significant projects brought up for approval. It also asks the board to look forward, at planned changes and at the risks and opportunities they carry. That forward look is where security governance earns its place, because the security consequence of a merger or a new service is easier to shape before the decision than after. The process is not a review of last quarter. It is a decision about the next one.
What good looks like
Give evaluate a standing agenda item with three inputs: the performance report, the forward plan and the significant project list. Ask for a written response to each report that names the objectives set or confirmed and the projects approved or deferred. Record the risks and opportunities the board considered, not only the decision. Send the response to the top management of each management system so the direction is traceable. Review the forward plan at least twice a year so the evaluation is not surprised by a change it could have shaped.
Evidence a board or an auditor asks for
The performance report and the board written response; the prioritised objectives for each management system; the significant project submissions and approvals; the forward plan with the security implications marked.
- Record The performance report and the board written response
- Record the prioritised objectives for each management system
- Record the significant project submissions and approvals
- Record the forward plan with the security implications marked
Where it commonly fails
- Management system reports received and filed with no objectives set in response
- Major security projects approved below governing body level
- A forward plan the board sees only after the investment is committed
What to do before publication
Before the edition 3 text is published, put clause 7.3.2 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.