ISO/IEC 27004 is the guidance standard on monitoring, measurement, analysis and evaluation for an information security management system. The 2016 edition explains how to evaluate security performance and management system effectiveness to serve ISO/IEC 27001, clause 9.1. It is guidance, not a certifiable requirement.
The short answer, expanded
ISO/IEC 27004 is the guidance standard on monitoring, measurement, analysis and evaluation for an information security management system. The 2016 edition explains how to evaluate security performance and management system effectiveness to serve ISO/IEC 27001, clause 9.1. It is guidance, not a certifiable requirement.
What to do next
The free check turns this answer into a dated reading for your organization. The register gives you the clause or measure behind the answer. If the question is about a customer or a tender, answer with the requirement standard and the certificate, not with a draft.
Run the free check Open the register
Related questions
Is it a requirement standard?
No. ISO/IEC 27001:2022 contains the requirement at clause 9.1. ISO/IEC 27004 explains how to evaluate performance and effectiveness.
Which edition applies today?
The 2016 edition is the published guidance. The third edition is a DIS at stage 40.60 and is not published.
Does it create a certificate?
No. There is no certification scheme for 27004.