ISO/IEC 27004:2016
Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation
ISO/IEC 27004:2016 provides guidelines intended to assist organizations in evaluating the information security performance and the effectiveness of an information security management system in order to fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes:
a) the monitoring and measurement of information security performance;
b) the monitoring and measurement of the effectiveness of an information security management system (ISMS) including its processes and controls;
c) the analysis and evaluation of the results of monitoring and measurement.
ISO/IEC 27004:2016 is applicable to all types and sizes of organizations.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$386.00 NZD
|
|
| HardCopy |
$430.00 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Structure and overview
5 Rationale
5.1 The need for measurement
5.2 Fulfilling the ISO/IEC 27001 requirements
5.3 Validity of results
5.4 Benefits
6 Characteristics
6.1 General
6.2 What to monitor
6.3 What to measure
6.4 When to monitor, measure, analyse and evaluate
6.5 Who will monitor, measure, analyse and evaluate
7 Types of measures
7.1 General
7.2 Performance measures
7.3 Effectiveness measures
8 Processes
8.1 General
8.2 Identify information needs
8.3 Create and maintain measures
8.3.1 General
8.3.2 Identify current security practices that can support information needs
8.3.3 Develop or update measures
8.3.4 Document measures and prioritize for implementation
8.3.5 Keep management informed and engaged
8.4 Establish procedures
8.5 Monitor and measure
8.6 Analyse results
8.7 Evaluate information security performance and ISMS effectiveness
8.8 Review and improve monitoring, measurement, analysis and evaluation processes
8.9 Retain and communicate documented information
Annex A (informative) An information security measurement model
Annex B (informative) Measurement construct examples
Annex C (informative) An example of free-text form measurement construction
Bibliography
Previous versions
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS ISO/IEC 27001:2023
Information security, cybersecurity and privacy protection – Information security management systems – Requirements
-
AS/NZS ISO/IEC 27001:2023 A1
Information security, cybersecurity and privacy protection - Privacy enhancing data de-identification framework
-
AS/NZS ISO/IEC 27002:2022
Information security, cybersecurity and privacy protection — Information security controls
-
AS/NZS ISO/IEC 27011:2025
Information security, cybersecurity and privacy protection – Information security controls based on ISO/IEC 27002 for telecommunications organizations
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Structure and overview
5 Rationale
5.1 The need for measurement
5.2 Fulfilling the ISO/IEC 27001 requirements
5.3 Validity of results
5.4 Benefits
6 Characteristics
6.1 General
6.2 What to monitor
6.3 What to measure
6.4 When to monitor, measure, analyse and evaluate
6.5 Who will monitor, measure, analyse and evaluate
7 Types of measures
7.1 General
7.2 Performance measures
7.3 Effectiveness measures
8 Processes
8.1 General
8.2 Identify information needs
8.3 Create and maintain measures
8.3.1 General
8.3.2 Identify current security practices that can support information needs
8.3.3 Develop or update measures
8.3.4 Document measures and prioritize for implementation
8.3.5 Keep management informed and engaged
8.4 Establish procedures
8.5 Monitor and measure
8.6 Analyse results
8.7 Evaluate information security performance and ISMS effectiveness
8.8 Review and improve monitoring, measurement, analysis and evaluation processes
8.9 Retain and communicate documented information
Annex A (informative) An information security measurement model
Annex B (informative) Measurement construct examples
Annex C (informative) An example of free-text form measurement construction
Bibliography