ISO/IEC 27004:2016 has 28 clause and structural records. Each page states the guidance in plain words, the practical reading, the evidence an assessor asks for and the question an auditor will put to you. The 2016 edition is still the published edition; the DIS revision is not public.
Introduction and structure
Clause 5. Rationale: why measure
Clause 6. What, when and who to monitor and measure
Clause 7. Types of measures
Clause 8. The measurement processes
- 8.1The monitoring, measurement, analysis and evaluation processes
- 8.2Identify information needs
- 8.3Create and maintain measures
- 8.3.1Create measures once, then review and update them at planned intervals and on substantial change
- 8.3.2Identify current security practices that can support information needs
- 8.3.3Develop or update measures
- 8.3.4Document measures and prioritise for implementation
- 8.3.5Keep management informed and engaged
- 8.4Establish procedures
- 8.5Monitor and measure
- 8.6Analyse results
- 8.7Evaluate information security performance and ISMS effectiveness
- 8.8Review and improve the monitoring, measurement, analysis and evaluation processes
- 8.9Retain and communicate documented information
The guidance statement is our reading of the held ISO/IEC 27004:2016 edition. The DIS text is not public and is not quoted.