ISO & IEC / Guidance
ISO/IEC 27004:2016 Measure whether security works
ISO/IEC 27004 focuses on monitoring, measurement and evaluation of information security performance and ISMS effectiveness. It encourages useful measures tied to decisions, rather than collecting metrics simply because they are easy to count.
The place in the system
Where it fits
It supports the performance evaluation work in ISO/IEC 27001, with an edition-alignment check needed when using it beside 27001:2022.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Choose a management question before choosing a metric.
- Define the source, owner and review interval for each measure.
- Record decisions made when measurements reveal weak or missing controls.
Evidence to look for
- Measurement definition sheet
- Trend and exception review
- Improvement decision log
Illustrative example
What it could look like
A dashboard reports that most users completed awareness training but says little about risky behaviour. The ISMS team adds measures tied to real control outcomes and uses the results to prioritize changes.
Boundary to keep clear
The published 2016 text references the 2013 edition of 27001; metrics should not be treated as a fixed compliance score or a substitute for evaluation.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.