The ISO document is a draft
A DIS cannot be cited as the applicable standard and cannot be certified against. If a contract or questionnaire cites ISO 27004, the citation needs a version and a status. What the record shows.
For the ISMS manager, the CISO and the consultant who certifies them
The measurement guidance is being rewritten. Your clause 9.1 evidence is due now.
ISO/IEC DIS 27004 is Edition 3 of the guidance on monitoring, measurement, analysis and evaluation. It is at stage 40.60, close of voting, and it is not published. The requirement you are audited against is already ISO/IEC 27001:2022, clause 9.1. This site separates the published 2016 guidance from the draft, clause by clause and measure by measure, so you can prepare on the requirement and use the revision as a warning, not a plan.
Read from the published text, not invented. Every clause and measure on this site is our statement of the held ISO/IEC 27004:2016 edition, cited so you can check any line against the official copy.
28 clause records36 worked measures171 evidence linesFree check, no accountFour markets
No account for the free check. Not legal advice; does not certify. Published by Gerard Blokdyk, The Art of Service. The official ISO record.
ISO record, read 21 October 2026
ISO/IEC DIS 27004
Close of voting- Title
- Monitoring, measurement, analysis and evaluation
- Edition
- Edition 3, 66 pages
- Committee
- ISO/IEC JTC 1/SC 27
- Stage
- 40.60, 16 September 2026
- Next
- 40.92, 40.93 or 40.99, by ballot result
- Replaces
- ISO/IEC 27004:2016
- Planning date
- 14 September 2027, an estimate
The DIS text is not public. The requirement is stated from 27001:2022, clause 9.1. Read the record.
Know what is measured, what it proves, and when the guidance changes.
Most teams can list their security metrics. Fewer can show which decision each metric informed. The register turns each clause into the evidence an assessor will request, so the answer is ready before the question.
Photo: MART PRODUCTION on Pexels, free licence.
01 / DRAFT
02 / REQUIREMENT
Your audit is on 27001:2022, clause 9.1
The requirement is to evaluate security performance and management system effectiveness. The guidance explains how. That work can start now, and the guidance can be adopted when it is published. The clause register.
03 / DATE
The date is an estimate
ISO records no publication date. The planning date used here is 14 September 2027, derived from the current stage and the normal ISO path and labelled an estimate. ISO has not committed to it. The dated timeline.
The check reads your certificate edition, the state of your measurement programme, the trace from measures to information needs, your reporting cadence, your next audit window and the guidance you use today. It returns a verdict, three actions and three clauses to read. It runs in the browser and sends nothing.
It never treats a missing answer as the lighter pathway. If an answer is missing, it says so and names the fact it needs.
Typical reading
Certified to 2022, still reporting activity
The requirement asks whether the programme works, not how many controls were implemented. The gap is in the information needs, the effectiveness measures and the evaluation step, not in the draft.
Every reading is computed from the answers, not typed by hand.
CLAUSES 1 TO 8
28 clause records
Scope, rationale, what to monitor, what to measure, when and who, the two measure types, and the eight process steps. Each page states the guidance, the practical reading, the evidence and the auditor question. Open the register.
ANNEXES A TO C
39 measure records
The measurement model, the 36 worked constructs and the free-form example. Each page states the information need, the formula, the target, the data source, the frequency and the owner. Open the measures.
THE KIT
Every line with an owner and a date
The paid kit turns the free register into a working file: PDF, CSV and XLSX, plus a dated plan. The specimen is labelled and free. See the specimen.
1. Fix the requirement
Confirm the certificate edition. Write the six clause 9.1 determinations: what, how, when, who measures, when analysed, who analyses. Keep the results.
2. Prune the measures
Trace each measure to an information need. Retire the ones that serve none. Add one effectiveness measure that shows a decision changed.
3. Watch the record
The stage will move. The watch emails when the stage, the guidance or the dates change, with the diff and the clause affected.
Is ISO/IEC DIS 27004 published?
No. ISO records it at stage 40.60, close of voting, on 16 September 2026. A DIS is a draft in the enquiry phase. It cannot be cited as the applicable standard, and no certificate is issued against it. The planning date of 14 September 2027 is an estimate, not an ISO date.
What is the latest version of ISO 27004?
The latest published edition is ISO/IEC 27004:2016. The draft third edition is ISO/IEC DIS 27004 at stage 40.60. The 2016 edition remains the published guidance until the new edition is published.
Does ISO 27004 change my ISO 27001 certificate?
No. ISO/IEC 27001:2022 is the certifiable requirement standard, and its clause 9.1 is the duty to evaluate security performance and management system effectiveness. ISO/IEC 27004 is guidance on how to do that. No certificate depends on 27004, and no transition audit is triggered by the draft.
What is in the free register?
One page for each of the 28 guidance clauses and structural sections of the published 2016 edition, and one page for each of the 39 annex records, including the 36 worked measurement examples in Annex B. Every page states the guidance, the practical reading, the evidence, the auditor question and the common gaps.
What does the USD 799 kit contain?
The full 67 unit register, 171 evidence lines and a dated plan in PDF, CSV and XLSX, with an owner, a status, a due date and an evidence pointer column on every line. A labelled specimen shows the shape before you buy.
Can I use the draft to prepare for an audit?
Yes, as guidance about a draft. Use it to understand the direction of travel, not as a requirement. Prepare the clause 9.1 evidence against the published requirement standard, and adopt the new guidance when it is published.
Is this legal advice or a certification?
No. It is a reference and a working register. It does not certify, audit or give legal advice, and it is not affiliated with or endorsed by ISO or IEC.