Question 1

What is ISO 27004?

Accepted Answer

ISO/IEC 27004 is the guidance standard on monitoring, measurement, analysis and evaluation for an information security management system. The 2016 edition explains how to evaluate security performance and management system effectiveness to serve ISO/IEC 27001, clause 9.1. It is guidance, not a certifiable requirement.

Question 2

What is the latest version of ISO 27004?

Accepted Answer

The latest published edition is ISO/IEC 27004:2016. The latest draft is ISO/IEC DIS 27004, Edition 3, at stage 40.60, close of voting on 16 September 2026. The draft is not a published version and cannot be cited as one.

Question 3

What changed from ISO 27004:2016 to the DIS?

Accepted Answer

The public record proves the edition and the re-basing: the 2016 edition served the 2013 requirement, and the DIS is Edition 3 under the 2022 family. The draft text is not public, so its own new wording, examples and annexes cannot be confirmed from the record.

Question 4

Can you certify against ISO 27004?

Accepted Answer

No. ISO/IEC 27004 is guidance. Certification is against ISO/IEC 27001:2022, the requirement standard. No certification body can issue a 27004 certificate, and no transition audit is triggered by the draft.

Question 5

When will ISO 27004 be published?

Accepted Answer

ISO records no publication date. The current stage is 40.60, close of voting on 16 September 2026. The next step depends on the ballot result. The planning date of 14 September 2027 is an estimate from the stage and the normal ISO path, not an ISO date.

Question 6

ISO 27004 vs ISO 27001: what is the difference?

Accepted Answer

ISO/IEC 27001:2022 is the requirement standard. An organization can be certified against it, and clause 9.1 requires performance evaluation. ISO/IEC 27004 is guidance on how to evaluate monitoring, measurement, analysis and evaluation. One is the rule, the other is the method.

Question 7

ISO 27004 vs ISO 27005: what is the difference?

Accepted Answer

ISO/IEC 27004 is about measuring whether the management system and its controls are working. ISO/IEC 27005 is about managing information security risk. Measurement can inform risk decisions, and risk treatment can supply the measures, but the two standards answer different questions.

Question 8

How do I use ISO 27004 as an implementation guide?

Accepted Answer

Start with the requirement, then use the guidance to shape the method. The order is: information needs, measures, procedures, monitoring, analysis, evaluation and records. The 2016 edition adds detail to each step; it does not replace the requirement.

Question 9

Does ISO 27004 contain requirements?

Accepted Answer

No. It contains guidance. The word requirement belongs to ISO/IEC 27001:2022, clause 9.1. A 27004 page may describe what good practice looks like, but it cannot create an obligation, and an auditor cannot raise a nonconformity against it.

Question 10

Where can I get the ISO 27004 PDF?

Accepted Answer

The official text is sold by ISO through the ISO Store. The 2016 edition is available there, and the draft is sold as a draft. This site does not host or reproduce either text. It states the guidance in its own words, with a source pointer on every page.

Question 11

Is there an ISO 27004 checklist?

Accepted Answer

Use the free register as the checklist: 28 clause records and 39 measure records, each with the evidence an assessor asks for. The paid kit adds the owner, status, due date and evidence pointer columns and exports the checklist as CSV and XLSX.

Question 12

How do I run an ISO 27004 gap analysis?

Accepted Answer

Compare the published 2016 guidance with the 2022 requirement first, because that gap is real today. Then compare the draft with your current method when the text is available. The free check gives the first reading; the kit gives the clause and measure rows for the second.

Question 13

What metrics does ISO 27004 suggest?

Accepted Answer

The 2016 edition does not prescribe a metric set. It gives a method and 36 worked constructs, including policy review, risk exposure, audit completion, incident cost, training, phishing, password quality, access review, physical entry, maintenance, change, malware, availability, firewall rules, log review, configuration, testing, third parties and incident trends. Each is an example to adapt.

Question 14

¿Hay una versión en español de ISO 27004?

Accepted Answer

ISO publishes the standard in several languages. The official Spanish edition, when available, is sold through the ISO Store or the national member body. This site does not host or reproduce the text in any language. It states the guidance in English, in its own words, with a source pointer on every page.

The questions buyers actually type