Exam ISO-IEC-27001-Lead-Implementer Topic 1 Question 149 Discussion

In the context of ISMS monitoring, an "information need" is typically defined as a high-level security question or statement that management wants answered to support decision-making. It frames what information is required and why, rather than specifying how it will be technically measured.
ISO/IEC 27001:2022 Clause 9.1 - Monitoring, measurement, analysis and evaluation requires organizations to determine:
* what needs to be monitored and measured,
* methods for monitoring and measurement,
* when monitoring and measurement shall be performed,
* and when results shall be analyzed and evaluated.
An information need precedes metrics and indicators. Examples include:
* "Are access controls preventing unauthorized access?"
* "Is incident response timely and effective?"
These are high-level questions, not technical specifications (Option A) and not predefined control lists (Option B). Metrics, dashboards, and KPIs are derived after the information need is defined.
This approach ensures that monitoring remains business-relevant and risk-focused, aligning measurement with objectives and management review requirements.