ISO/IEC 27001:2022 is the requirement standard. An organization can be certified against it, and clause 9.1 requires performance evaluation. ISO/IEC 27004 is guidance on how to evaluate monitoring, measurement, analysis and evaluation. One is the rule, the other is the method.
The short answer, expanded
ISO/IEC 27001:2022 is the requirement standard. An organization can be certified against it, and clause 9.1 requires performance evaluation. ISO/IEC 27004 is guidance on how to evaluate monitoring, measurement, analysis and evaluation. One is the rule, the other is the method.
What to do next
The free check turns this answer into a dated reading for your organization. The register gives you the clause or measure behind the answer. If the question is about a customer or a tender, answer with the requirement standard and the certificate, not with a draft.
Run the free check Open the register
Related questions
Which one does an auditor use?
The auditor uses the requirement standard and the certification scheme. The guidance can inform the method, not the finding.
Which one do I buy?
Buy 27001:2022 first. The guidance is useful, not required.
Which one is in my audit pack?
The clause 9.1 evidence is against 27001:2022. 27004 helps you design it.